Add a trademark policy for the SolidCraft name and logo

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Regenerate generated files and fold pending files [skip ci]
2026-11-03 10:35:58 +00:00 · 2026-10-28 11:19:36 -04:00 · 2026-10-28 14:56:01 +00:00 · 2026-10-28 12:19:10 +00:00 · 2026-10-28 12:18:53 +00:00 · 2026-10-28 12:18:28 +00:00
836 changed files with 113451 additions and 8672 deletions
@@ -1,5 +1,6 @@
 # cargo-nextest settings for CI (`cargo xtask test` does not use nextest).
-# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml).
+# CI builds the tests once and runs them in one job on a 32 vCPU runner (.github/workflows/ci.yml),
+# except the GPU path tracer's tests (the gpu-path group below), which run in four shards of their own.

 [profile.ci]
 # Heavy tests (one to twelve minutes each on a CI runner) that pull requests skip. They run on
@@ -72,6 +73,7 @@ priority = 100
 # Each nextest test has its own process/device. Concurrent cold lavapipe path
 # compiles contend for CPU and can exhaust the 600 s pipeline setup budget.
 # Serialize this module per CI shard; other tests retain their normal parallelism.
+# CI runs these in their own job (GPU path tests in ci.yml), split into count partitions.
 [test-groups.gpu-path]
 max-threads = 1

@@ -1,3 +1,6 @@
 # Preserve canonical source receipts and the runtime icon-discovery snapshot.
 .gitattributes text eol=lf
 /assets/icons/ui/design/requested_icons.txt text eol=lf
+# SolidCraft designs (.sc): a JSON document or a ZIP container, never Scala source, so they
+# stay out of GitHub's language statistics. Git's own text/binary detection handles both kinds.
+*.sc -linguist-detectable
@@ -6,6 +6,7 @@ body:
    attributes:
      value: |
        Thanks for taking the time to report this! Inside the app, **Report an Issue** fills most of this in for you, with the command, its settings and your environment.
+        Before reporting a boolean or modelling failure, please try to reproduce it on the latest nightly or a build from current `main`, and say which build you used.
  - type: textarea
    id: what
    attributes:
@@ -18,7 +19,8 @@ body:
    attributes:
      label: Steps to reproduce
      description: |
-        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.solidcraft --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        What you clicked or typed, in order. For a problem on a particular design, `solidcraft-cli script design.sc --out repro.json` turns its history into a script that `solidcraft-cli eval repro.json` replays; attach it, trimmed to the failing step if you can.
+        Using an AI agent with SolidCraft's MCP server? The `solidcraft-reporting` skill in [`skills/`](https://github.com/tangency-labs/solidcraft/tree/main/skills) has it reproduce the problem in a fresh design and write these steps for you.
      placeholder: |
        1. Sketch a circle on the XY plane
        2. Extrude it 10 mm
@@ -9,9 +9,10 @@ parameter to watch the timeline rebuild. [Documentation](https://docs.solidcraft
 [ROADMAP](https://github.com/bherbruck/solidcraft/blob/main/ROADMAP.md#known-limitations) lists
 the known limitations. Designs from every earlier version open in this one.

-**Upgrading from 0.7 or earlier.** 0.8 changed the Linux app ID to `ai.storyteller.solidcraft`:
-`flatpak update` offers to replace the old app, and the `.deb`, `.rpm` and AppImage remove the old
-menu entry.
+**New app ID.** The app ID is now `io.tangencylabs.solidcraft` (it was `ai.storyteller.solidcraft`,
+and `ai.storyteller.solvecraft` up to 0.7): `flatpak update` offers to replace the old app, the
+`.deb`, `.rpm` and AppImage remove the old menu entry, and settings stay. On macOS the bundle ID
+changed too, so macOS asks once more for the permissions it had granted.

 **Upgrading from 0.5 or earlier.** 0.6 renamed SolveCraft to SolidCraft and made the zip
 container the default save format. `.solvecraft` designs, old settings folders and
@@ -42,16 +43,16 @@ installing SolidCraft; keep both remotes in the same user installation:
 ```sh
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --user --if-not-exists solidcraft https://docs.solidcraft.io/flatpak/solidcraft.flatpakrepo
-flatpak install --user solidcraft ai.storyteller.solidcraft
-flatpak run ai.storyteller.solidcraft
+flatpak install --user solidcraft io.tangencylabs.solidcraft
+flatpak run io.tangencylabs.solidcraft
 ```

 A remote added from the old `bherbruck.github.io` address no longer finds updates: run
 `flatpak remote-modify --user --url=https://docs.solidcraft.io/flatpak/repo/ solidcraft`, then
 `flatpak update --user`.

-Flatpak installs from 0.7 or earlier use the old ID `ai.storyteller.solvecraft`: `flatpak update --user`
-offers to replace it with `ai.storyteller.solidcraft`, and settings move along.
+Flatpak installs under an old ID (`ai.storyteller.solidcraft`, or `ai.storyteller.solvecraft` from 0.7 or
+earlier): `flatpak update --user` offers to replace it with `io.tangencylabs.solidcraft`, and settings move along.

 Single-file `.flatpak` bundles include the runtime repository address; missing runtimes
 still need an internet connection. [Linux installation details](https://docs.solidcraft.io/guide/getting-started.html#linux-flatpak).
@@ -9,12 +9,14 @@
 # Documentation, packaging, the other workflows and the GitHub bots' scripts select nothing:
 # no native job runs for them, on pull requests or on main.
 # Tests are built and run in one job on a big runner, slowest first, starting beside the repository
-# checks (no archive to upload and download). A few heavy tests (see .config/nextest.toml) are
-# skipped on pull requests and run on pushes to main and nightly. The Windows jobs (D3D12 shaders
-# and app startup), the reference tests and the doc tests run on main and nightly only, not on
-# pull requests (the fast lane, in Select checks); a break there is fixed forward on main. Only
-# main saves the build caches; pull requests restore them. sccache is on a Blacksmith sticky disk that
-# only main commits.
+# checks (no archive to upload and download). The GPU path tracer's tests run one at a time
+# (.config/nextest.toml), so they have a job of their own in four shards (GPU path tests). A few
+# heavy tests (see .config/nextest.toml) are skipped on pull requests and run on pushes to main and
+# nightly. The reference tests and the doc tests run in the merge queue, on main and nightly, not
+# on pull requests (the fast lane, in Select checks); a break there is fixed forward on main. The
+# Windows jobs (D3D12 shaders and app startup) run nightly, and in the merge queue only for a group
+# that changes what they exercise. Only main saves the build caches; pull requests restore them.
+# sccache is on a Blacksmith sticky disk that only main commits.
 # A push to main runs only the repository checks when a passing merge-queue run tested that very
 # commit, or when nothing a build reads changed since the last push to main whose run passed.
 # Otherwise it runs everything.
@@ -30,7 +32,7 @@
 # reads `ci` from the newest run of a commit, so a run without it would block a PR that passed.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
 # Every Linux job runs on Blacksmith's Ubuntu 24.04 runners (blacksmith-<N>vcpu-ubuntu-2404), sized
-# per job: 32 vCPU for the tests, 16 for Clippy, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
+# per job: 32 vCPU for the tests, 16 for Clippy, the GPU path tests, the archive build (nightly) and the merge queue's, 8 for compiles, doc and reference tests, 4 for the light checks, 2 for Select checks and ci.
 # The Windows shader job runs on Blacksmith's Windows Server 2025 runners (blacksmith-8vcpu-windows-2025);
 # the Windows app startup smoke stays on windows-latest, which has a desktop session that presents frames.
 # Pull requests, forks included, the merge queue, pushes to main and the nightly run all use them:
@@ -96,13 +98,17 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      contents: read
-      # To ask whether the merge queue already tested a commit pushed to main.
+      # To ask whether the merge queue already tested a commit pushed to main, and which labels the
+      # pull requests of a merge group carry (the render-tests opt-in).
+      pull-requests: read
      actions: read
    outputs:
      native: ${{ steps.paths.outputs.native }}
      kernel: ${{ steps.paths.outputs.kernel }}
      goldens: ${{ steps.paths.outputs.goldens }}
      windows: ${{ steps.paths.outputs.windows }}
+      # The GPU path tests run (see the rule where it is computed). The job's `if` and the `ci` job's check both read this, so they cannot disagree.
+      gpu: ${{ steps.paths.outputs.gpu }}
      full: ${{ steps.paths.outputs.full }}
      # Code changed on a pull request that has no approved-for-ci label yet: only Quick compile.
      quick: ${{ steps.paths.outputs.quick }}
@@ -122,8 +128,11 @@ jobs:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_SHA: ${{ github.sha }}
+          GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+          GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          RENDER_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'render-tests') }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          REPO: ${{ github.repository }}
          APPROVED: ${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}
@@ -133,6 +142,7 @@ jobs:
          kernel=false
          goldens=false
          windows=false
+          gpu_paths=false
          full=true
          packages=
          # Whether the NUL-separated paths in $1 reach any code: scripts/ci/affected.py selects
@@ -144,6 +154,46 @@ jobs:
            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
          }
+          # Whether the NUL-separated paths in $1 (the diff $2) reach what the Windows D3D12 jobs
+          # exercise: the GPU crate and its shaders, the app and its startup, the viewport's wgpu
+          # glue, the vendored egui-wgpu, their scripts, or a lockfile change that moves the
+          # graphics stack (wgpu, naga, egui, winit, windows). Pull requests and merge groups share it.
+          windows_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
+                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
+              esac
+            done < "$1"
+            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$1" \
+              && git diff "$2" -- Cargo.lock \
+                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
+              windows=true
+            fi
+          }
+          # Whether the NUL-separated paths in $1 are render code: the render crate, the path
+          # tracer and its shaders in the GPU crate, the render workspace UI, the render assets.
+          # Core, kernel and CI changes do not trigger the path tests (about 56 runner-minutes):
+          # the tracer reads the scene through interfaces the other tests cover, and the nightly
+          # runs them for everything.
+          gpu_paths() {
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                crates/render/*|crates/gpu/src/path/*|crates/ui-egui/src/render_workspace*|assets/render/*) gpu_paths=true ;;
+              esac
+            done < "$1"
+          }
+          # Opt-in for a big render change: a pull request labelled render-tests, or a merge group
+          # holding one (its pull requests are the (#N) of its squash commits), runs them whatever
+          # the paths say.
+          group_has_render_label() {
+            for pr in $(git log --format=%s "$1" | grep -o '(#[0-9]*)$' | tr -d '(#)'); do
+              if gh api "repos/$REPO/issues/$pr" --jq '.labels[].name' | grep -qx render-tests; then
+                return 0
+              fi
+            done
+            return 1
+          }
          if [ "$EVENT_NAME" = push ]; then
            # The queue lands the very commit its merge_group run tested. If that run passed,
            # testing the push again proves nothing new; otherwise (a merge that skipped the
@@ -164,15 +214,33 @@ jobs:
              # push before may never have run: a newer push cancels a waiting one).
              echo "$tested..$PUSH_SHA changes no code: repository checks only."
            else
-              # Code changed (or the push can't be compared): main runs everything.
+              # Code changed (or the push can't be compared): main runs everything but Windows.
+              # The merge queue ran Windows for the changes that reach it, and the nightly runs it
+              # for everything else (it passed 129 of 129 non-PR runs before this).
              full=true
              packages=
              native=true
-              windows=true
            fi
+          elif [ "$EVENT_NAME" = merge_group ]; then
+            native=true
+            # Windows (about 16 runner-minutes) only for a group that changes what it exercises;
+            # the nightly runs it whatever changed. A group that can't be compared runs it.
+            if git diff --no-renames --name-only -z "$GROUP_BASE_SHA...$GROUP_HEAD_SHA" > "$RUNNER_TEMP/ci-paths"; then
+              windows_paths "$RUNNER_TEMP/ci-paths" "$GROUP_BASE_SHA...$GROUP_HEAD_SHA"
+              gpu_paths "$RUNNER_TEMP/ci-paths"
+              if [ "$gpu_paths" = false ] && group_has_render_label "$GROUP_BASE_SHA..$GROUP_HEAD_SHA"; then
+                gpu_paths=true
+              fi
+            else
+              windows=true
+              gpu_paths=true
+            fi
+            echo "windows=$windows gpu_paths=$gpu_paths for $GROUP_BASE_SHA...$GROUP_HEAD_SHA"
          elif [ "$EVENT_NAME" != pull_request ]; then
+            # The nightly run and Run workflow: everything, Windows included.
            native=true
            windows=true
+            gpu_paths=true
          else
            # Compare both old and new paths of renames; unknown paths run native checks.
            git diff --no-renames --name-only -z "$BASE_SHA...$HEAD_SHA" > "$RUNNER_TEMP/ci-paths"
@@ -185,19 +253,9 @@ jobs:
              case "$path" in
                crates/kernel/*|vendor/truck-*|tests/robustness/*) goldens=true ;;
              esac
-              # What the Windows D3D12 jobs exercise: the GPU crate and its shaders, the app and
-              # its startup, the viewport's wgpu glue, the vendored egui-wgpu, their scripts.
-              case "$path" in
-                crates/gpu/*|apps/solidcraft/*|crates/ui-egui/src/gpu.rs|vendor/egui-wgpu/*) windows=true ;;
-                tools/windows-*.ps1|.github/workflows/ci.yml|rust-toolchain*|.cargo/*) windows=true ;;
-              esac
            done < "$RUNNER_TEMP/ci-paths"
-            # A lockfile change that moves the graphics stack (wgpu, naga, egui, winit, windows).
-            if [ "$windows" = false ] && grep -qxz 'Cargo.lock' "$RUNNER_TEMP/ci-paths" \
-              && git diff "$BASE_SHA...$HEAD_SHA" -- Cargo.lock \
-                | grep -Eq '^[ +-]name = "(wgpu[a-z_-]*|naga|egui[a-z_-]*|eframe|winit|windows[a-z_-]*|d3d12)"'; then
-              windows=true
-            fi
+            # Computed as for a merge group, then turned off below (the fast lane).
+            windows_paths "$RUNNER_TEMP/ci-paths" "$BASE_SHA...$HEAD_SHA"
            # Pull requests build and test the touched packages and their dependents; nothing
            # selected means no code changed.
            select_packages "$RUNNER_TEMP/ci-paths"
@@ -242,8 +300,28 @@ jobs:
              goldens=false
            fi
          fi
+          # The GPU path tests (their own job, about 56 runner-minutes) are for render changes only:
+          # - on a pull request, when it carries the render-tests label (opt-in for a big render
+          #   change) or touches render code (gpu_paths); no other pull request runs them;
+          # - in the merge queue, when the group's diff touches render code or one of its pull
+          #   requests carries render-tests;
+          # - in the nightly and by hand, always, so anything the above skipped is caught within a day;
+          # - not on a push to main: the queue tested that commit, or the nightly will.
+          gpu=false
+          if [ "$native" = true ]; then
+            case "$EVENT_NAME" in
+              pull_request)
+                gpu_paths "$RUNNER_TEMP/ci-paths"
+                gpu=$gpu_paths
+                if [ "$RENDER_LABEL" = true ]; then gpu=true; fi ;;
+              merge_group) gpu=$gpu_paths ;;
+              push) gpu=false ;;
+              *) gpu=true ;;
+            esac
+          fi
          {
            echo "native=$native"
+            echo "gpu=$gpu"
            echo "kernel=$kernel"
            echo "goldens=$goldens"
            echo "windows=$windows"
@@ -286,6 +364,10 @@ jobs:
          cargo test -p xtask ui_containers --locked
      - name: Sorted lists
        run: cargo xtask lists
+      - name: Agent router and skills cite real files
+        run: |
+          cargo xtask skills
+          cargo test -p xtask skills --locked
      - name: Design format pending changes
        run: bash scripts/test-format-pending.sh
      - name: Web app offline use and updates (headless Chrome)
@@ -487,8 +569,10 @@ jobs:
          scope=(--workspace)
          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
          status=0
+          # The GPU path tracer's tests run in their own job (GPU path tests): one at a time, they
+          # took about 36 of this job's 45 minutes.
          cargo nextest run "${scope[@]}" --cargo-profile ci --locked --profile ci --no-tests=pass \
-            --ignore-default-filter -E "$base" || status=1
+            --ignore-default-filter -E "($base) & not (package(=solidcraft-gpu) & test(/^path::/))" || status=1
          if [ "$status" != 0 ]; then
            # A failed golden gets the hint to re-record it (junit.xml lists the failures).
            if [ -f "$junit" ] && tr '\n' ' ' < "$junit" | grep -q '<testcase name="tests::robustness_goldens::[^"]*"[^>]*>[[:space:]]*<failure'; then
@@ -508,6 +592,96 @@ jobs:
          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
          retention-days: 7

+  gpu-path-tests:
+    name: GPU path tests (${{ matrix.shard }}/4)
+    # The GPU path tracer's tests (about 108) compile their pipelines on lavapipe, one test at a
+    # time (the gpu-path test group in .config/nextest.toml keeps them within the 600 s pipeline
+    # setup budget). Serial, they took about 36 minutes, the longest chain in Native Linux tests;
+    # here four shards run beside it. Their filter is the one Native Linux tests leaves out, so
+    # every test runs exactly once.
+    # 16 vCPU, not 8: lavapipe compiles on every core, and on 8 vCPU one test went past the 600 s
+    # budget (665 s, against 204 s for the same test in another run) and a shard took 35 minutes.
+    needs: changes
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.gpu == 'true' }}
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    env:
+      # As in Native Linux tests: lavapipe draws, and a test without an adapter fails.
+      SOLIDCRAFT_GPU: software
+      SOLIDCRAFT_REQUIRE_GPU: "1"
+      # lavapipe's own shader cache (below).
+      MESA_SHADER_CACHE_DIR: /home/runner/.cache/mesa-gpu
+      CARGO_INCREMENTAL: "0"
+      RUSTC_WRAPPER: sccache
+      SCCACHE_DIR: /home/runner/.cache/sccache
+      SCCACHE_CACHE_SIZE: 20G
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install a software Vulkan driver (lavapipe)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers libvulkan1
+      - name: Size parallel compiles to the job's memory
+        run: scripts/ci/build-jobs.sh
+      - uses: dtolnay/rust-toolchain@stable
+      # sccache lives on a Blacksmith sticky disk (an ext4 volume cloned from the last snapshot,
+      # no 10 GB limit and no download). Only main commits it; pull requests, the merge queue and
+      # forks mount a clone and never write back, so nothing they build can reach main's cache.
+      # The shards build the same thing, so only the first one commits it (and saves the cache).
+      - name: Mount the compiler cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-sccache-gpu
+          path: /home/runner/.cache/sccache
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # The first test in a shard to build the path pipeline compiles it cold on lavapipe (335 to
+      # 665 s, against the 600 s setup budget); every later one reads Mesa's disk cache (about
+      # 30 s). Keeping that cache from main's last run lets the first test read it too, until the
+      # shaders change. Same sticky disk rules as the compiler cache.
+      - name: Mount lavapipe's shader cache
+        uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1.7.2
+        continue-on-error: true
+        with:
+          key: ${{ github.repository }}-mesa-gpu
+          path: /home/runner/.cache/mesa-gpu
+          commit: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 && 'on-change' || 'false' }}
+      # Main saves the cache; every other run restores it, read-only.
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: native-gpu
+          save-if: ${{ github.ref == 'refs/heads/main' && matrix.shard == 1 }}
+      - name: Set up compiler cache
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.16.0
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
+        with:
+          tool: cargo-nextest
+      - name: Run one shard of the GPU path tests
+        env:
+          SHARD: ${{ matrix.shard }}
+        run: |
+          # None of these is in the default filter (the heavy tests), so pull requests, the merge
+          # queue, main and nightly all run every one of them, as before. `count` deals the tests
+          # out in turn (27 each); `hash` split them 41/40/27 across three shards.
+          cargo nextest run -p solidcraft-gpu --cargo-profile ci --locked --profile ci --no-tests=pass \
+            --ignore-default-filter -E 'test(/^path::/)' --partition "count:$SHARD/4"
+      - name: Compiler cache statistics
+        if: always()
+        run: sccache --show-stats
+      - name: Upload test timings
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: junit-gpu-${{ matrix.shard }}
+          path: ${{ env.CARGO_TARGET_DIR || 'target' }}/nextest/ci/junit.xml
+          retention-days: 7
+
  action-matrix:
    # Every ordinary action on every face, edge, vertex and body of the design corpus, against
    # tests/action_matrix/baseline.json (docs/action-matrix.md). Every test run checks a sample;
@@ -769,7 +943,7 @@ jobs:
    # commit's real run instead: the merge queue reads `ci` from the newest run of a commit, so a
    # run without a passing `ci` would block a pull request that passed (#1850, #3182, #3252).
    name: ci
-    needs: [changes, checks, quick-compile, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
+    needs: [changes, checks, quick-compile, clippy, build-tests, tests, gpu-path-tests, doc-tests, oracle, windows-fxc, windows-startup]
    if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
@@ -817,6 +991,8 @@ jobs:
          BUILD: ${{ needs.build-tests.result }}
          EVENT_NAME: ${{ github.event_name }}
          TESTS: ${{ needs.tests.result }}
+          GPU_RUN: ${{ needs.changes.outputs.gpu }}
+          GPU: ${{ needs.gpu-path-tests.result }}
          DOCS: ${{ needs.doc-tests.result }}
          ORACLE: ${{ needs.oracle.result }}
          WINDOWS_FXC: ${{ needs.windows-fxc.result }}
@@ -836,6 +1012,10 @@ jobs:
            fi
            test "$TESTS" = success
          fi
+          # The same output decides whether the GPU path tests run (their job's `if`).
+          if [ "$GPU_RUN" = true ]; then
+            test "$GPU" = success
+          fi
          if [ "$DOCTESTS" = true ]; then
            test "$DOCS" = success
          fi
@@ -0,0 +1,42 @@
+# Nightly import checks on real-world STEP files (#1397): the external corpus in
+# tests/external-corpus.toml is downloaded (hash-verified), imported headless, and checked
+# against tolerance-based expectations — body counts, total volume and area, time and memory
+# budgets. It is not part of `cargo xtask ci`: it downloads from the internet.
+#
+# Import results should improve over time (healing, edge merging, meshing). When a check fails
+# because the numbers moved for the better (or the source changed upstream), re-record with
+# `cargo xtask external-corpus --bless "why"` in a pull request, never by editing numbers.
+name: External corpus
+
+on:
+  schedule:
+    - cron: '40 3 * * *'
+  workflow_dispatch:
+    inputs:
+      only:
+        description: "Run only this corpus entry name (empty = every entry)"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  corpus:
+    name: Import the external STEP corpus
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build the CLI
+        run: cargo build --profile ci -p solidcraft-cli
+      - name: Import and check every entry
+        env:
+          ONLY: ${{ inputs.only }}
+        run: |
+          if [ -z "$ONLY" ]; then
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli
+          else
+            cargo run -q -p xtask -- external-corpus --cli target/ci/solidcraft-cli --only "$ONLY"
+          fi
@@ -16,7 +16,7 @@ on:
 permissions:
  contents: read # to check out scripts/kernel-paused
  issues: write
-  pull-requests: read # to list a PR's changed paths
+  pull-requests: write # to list a PR's changed paths and add its label
  discussions: write

 concurrency:
@@ -55,13 +55,15 @@ jobs:
      - name: XML, desktop entry, AppStream, Flatpak manifest
        run: |
          xmllint --noout assets/platforms/windows/solidcraft.wxs assets/platforms/windows/solidcraft.en-us.wxl assets/platforms/macos/*.plist* assets/platforms/linux/*.xml*
-          desktop-file-validate assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          # The window's X11 class is its app id; the old id stays only as the rename shims.
-          grep -qx 'StartupWMClass=ai.storyteller.solidcraft' assets/platforms/linux/ai.storyteller.solidcraft.desktop
-          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in
+          desktop-file-validate assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          # The window's X11 class is its app id; the old ids stay only as the rename shims.
+          grep -qx 'StartupWMClass=io.tangencylabs.solidcraft' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
+          grep -q '<id>ai.storyteller.solidcraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -q '<id>ai.storyteller.solvecraft</id>' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in
+          grep -qx 'X-Flatpak-RenamedFrom=ai.storyteller.solidcraft.desktop;ai.storyteller.solvecraft.desktop;' assets/platforms/linux/io.tangencylabs.solidcraft.desktop
          grep -qF -e '--end-of-life-rebase=' packaging/flatpak-site.sh
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.solidcraft.metainfo.xml"
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.solidcraft.bundle.yml')); assert m['id'] == 'ai.storyteller.solidcraft' and m['command'] == 'solidcraft'"
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in >"$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/io.tangencylabs.solidcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/io.tangencylabs.solidcraft.bundle.yml')); assert m['id'] == 'io.tangencylabs.solidcraft' and m['command'] == 'solidcraft'"
          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/snap/snapcraft.yaml')); assert m['name'] == 'solidcraft' and m['confinement'] == 'strict' and m['apps']['solidcraft']['command'] == 'usr/bin/solidcraft'"
          python3 -m py_compile packaging/linux/snap-smoke.py
@@ -65,6 +65,7 @@ jobs:
        run: |
          mkdir -p site
          cp -r target/book/. site/
+          bash docs/book/seo.sh site  # canonical links, robots.txt, sitemap.xml
          cp -r dist/web site/app
      - uses: actions/configure-pages@v5
        id: pages
@@ -5,7 +5,9 @@
 # the draft separately; see docs/releasing.md. Tags and pushes to main do not trigger releases.
 # At midnight Eastern, changed main commits build and publish a nightly pre-release.
 # A version with a suffix (0.2.0-rc.1) is a pre-release.
-# The macOS app is signed and notarized when the APPLE_* secrets exist, nothing else is signed yet.
+# The macOS app is signed and notarized when the APPLE_* secrets exist. The Windows binaries and
+# MSI are Authenticode-signed through SignPath Foundation when the SIGNPATH_API_TOKEN secret exists
+# (see the windows job). Nothing else is signed yet.
 #
 #   Linux x86_64, aarch64   AppImage (+ .zsync), .deb, .rpm, .flatpak, .snap, .tar.gz packaging/linux
 #   FreeBSD x86_64          .tar.gz (built in a FreeBSD VM)                        packaging/freebsd
@@ -18,6 +20,8 @@
 # releases/latest/download/<name> links in the README keep working across releases.
 #
 # A dry run: dispatch with draft=false (the default). Only the release branch may create drafts.
+# A dry run from any branch also test-signs the Windows files when SIGNPATH_API_TOKEN exists:
+#   gh workflow run release.yml --ref <branch> -f draft=false [-f signpath_signing_policy=test-signing]
 name: Release

 on:
@@ -32,6 +36,10 @@ on:
        description: "Create/update a draft (release branch only; off: build artifacts only)"
        type: boolean
        default: false
+      signpath_signing_policy:
+        description: "SignPath signing policy for the Windows files (empty: the repository variable, else test-signing)"
+        type: string
+        default: ""

 permissions:
  contents: read
@@ -289,7 +297,7 @@ jobs:
            export CARGO_TARGET_DIR=/var/tmp/solidcraft-target CARGO_BUILD_JOBS=4
            bash packaging/freebsd/package.sh
            tar -tzf dist/release/solidcraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/ai\.storyteller\.solvecraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
+              | grep -E '/bin/solidcraft$|/bin/solidcraft-cli$|/share/applications/io\.tangencylabs\.solidcraft\.desktop$|/share/doc/solidcraft/THIRD-PARTY-LICENSES\.txt$'
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-freebsd-x86_64
@@ -378,7 +386,14 @@ jobs:
    name: Windows ${{ matrix.arch }}
    needs: [version, icons]
    if: needs.version.outputs.build == 'true'
+    # Must stay a GitHub-hosted runner, like every job before it: SignPath's open-source policy
+    # only signs builds whose jobs all ran on GitHub-hosted runners.
    runs-on: windows-latest
+    # actions: read lets the SignPath action read this job's details and fetch the uploaded
+    # artifact with GITHUB_TOKEN (the workflow default above grants contents: read only).
+    permissions:
+      contents: read
+      actions: read
    strategy:
      fail-fast: false
      matrix:
@@ -389,6 +404,16 @@ jobs:
          - { arch: arm64, target: aarch64-pc-windows-msvc }
    env:
      SOLIDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      # Authenticode signing through SignPath Foundation (docs/releasing.md, "Windows signing").
+      # Only when the API token secret exists: forks and repositories without it build unsigned,
+      # exactly as before. `if:` can't read secrets, so the check goes through this variable.
+      SIGN_WINDOWS: ${{ secrets.SIGNPATH_API_TOKEN != '' }}
+      # The one switch between the self-signed test certificate (test-signing) and the real one
+      # (release-signing): a dispatch input, else the SIGNPATH_SIGNING_POLICY repository variable,
+      # else test-signing.
+      SIGNPATH_SIGNING_POLICY: ${{ inputs.signpath_signing_policy || vars.SIGNPATH_SIGNING_POLICY || 'test-signing' }}
+      SIGNPATH_ORGANIZATION_ID: fa603ff4-c702-404b-8588-a524371c7a4e
+      SIGNPATH_PROJECT_SLUG: solidcraft
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -407,10 +432,109 @@ jobs:
          dotnet tool install --global wix --version 5.0.2
          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
      - name: Build and package (msi, portable zip)
+        if: env.SIGN_WINDOWS != 'true'
        shell: pwsh
        env:
          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+
+      # ---- signed path ---------------------------------------------------------------------------
+      # SignPath's GitHub integration (docs.signpath.io/trusted-build-systems/github): the files go
+      # up as a workflow artifact, SignPath fetches that artifact itself (so it can verify it came
+      # from this workflow run), signs it, and the action downloads the signed copy. GitHub stores
+      # artifacts as zips, so packaging/windows/signpath-artifact-configuration.xml (pasted into the
+      # SignPath project) describes a zip holding the files at its top level.
+      # Two rounds: the .exe files first, so the MSI, the portable zip and the plain .exe all carry
+      # signed binaries; then the MSI built from them.
+      - name: Build and stage the binaries for signing
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase stage
+      - name: Upload the unsigned binaries
+        id: unsigned-exes
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-exes-windows-${{ matrix.arch }}
+          path: target/windows-package/${{ matrix.arch }}/*.exe
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the binaries (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-exes.outputs.artifact-id }}
+          wait-for-completion: true
+          # release-signing requests wait for a person to approve them in SignPath; give that an
+          # hour instead of the default 10 minutes. test-signing requests finish in seconds.
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-exes-${{ matrix.arch }}
+      - name: Put the signed binaries in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $stage = "target/windows-package/${{ matrix.arch }}"
+          foreach ($exe in 'solidcraft.exe', 'solidcraft-cli.exe', 'solvecraft-cli.exe') {
+            $signed = "target/windows-package/signed-exes-${{ matrix.arch }}/$exe"
+            # The artifact configuration matches each file optionally, so check that every file
+            # actually came back signed rather than trusting the request's success.
+            $sig = Get-AuthenticodeSignature $signed
+            if (-not $sig.SignerCertificate) { throw "$exe came back from SignPath without a signature ($($sig.Status))" }
+            # The test certificate is self-signed, so Status is not Valid until release-signing.
+            Write-Output "$exe signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+            Copy-Item -Force $signed "$stage/$exe"
+          }
+      - name: Package the signed binaries (msi, portable zip)
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        env:
+          SOLIDCRAFT_ICONS: ${{ github.workspace }}/icons
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }} -Phase package
+      - name: Upload the unsigned MSI
+        id: unsigned-msi
+        if: env.SIGN_WINDOWS == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signpath-unsigned-msi-windows-${{ matrix.arch }}
+          path: dist/release/*.msi
+          if-no-files-found: error
+          retention-days: 3
+      - name: Sign the MSI (SignPath, ${{ env.SIGNPATH_SIGNING_POLICY }})
+        if: env.SIGN_WINDOWS == 'true'
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ env.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ env.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY }}
+          github-artifact-id: ${{ steps.unsigned-msi.outputs.artifact-id }}
+          wait-for-completion: true
+          wait-for-completion-timeout-in-seconds: 3600
+          output-artifact-directory: target/windows-package/signed-msi-${{ matrix.arch }}
+      - name: Put the signed MSI in place
+        if: env.SIGN_WINDOWS == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = Get-Item "dist/release/*.msi"
+          $signed = "target/windows-package/signed-msi-${{ matrix.arch }}/$($msi.Name)"
+          $sig = Get-AuthenticodeSignature $signed
+          if (-not $sig.SignerCertificate) { throw "$($msi.Name) came back from SignPath without a signature ($($sig.Status))" }
+          Write-Output "$($msi.Name) signed by $($sig.SignerCertificate.Subject) (status: $($sig.Status))"
+          Copy-Item -Force $signed $msi.FullName
+          "Windows ${{ matrix.arch }}: Authenticode-signed through SignPath (policy $env:SIGNPATH_SIGNING_POLICY, $($sig.SignerCertificate.Subject))." >> $env:GITHUB_STEP_SUMMARY
+      - name: Note the unsigned build
+        if: env.SIGN_WINDOWS != 'true'
+        shell: pwsh
+        run: '"Windows ${{ matrix.arch }}: unsigned (no SIGNPATH_API_TOKEN secret)." >> $env:GITHUB_STEP_SUMMARY'
+
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-windows-${{ matrix.arch }}
@@ -11,3 +11,7 @@ __pycache__/

 # cargo-mutants output (docs/mutation-testing.md)
 mutants.out*/
+
+# external corpus downloads (cargo xtask external-corpus, #1397): fetched at test time,
+# hash-pinned in tests/external-corpus.toml; never commit case data
+/corpus/
@@ -1,222 +1,47 @@
-# SolidCraft — instructions for agents
+# SolidCraft: instructions for agents

-SolidCraft is a clean-room, open-source, pure-Rust parametric 3D CAD application:
-sketches with a constraint solver, a parametric timeline of features, a B-rep
-kernel, and a desktop UI that agents can drive. Projects published by
-[storytold](https://github.com/storytold) can serve as references for implementation conventions.
-Any code adapted from other projects (MIT OR Apache-2.0) is noted in ATTRIBUTION.md.
+SolidCraft is a clean-room, pure-Rust parametric 3D CAD app (sketch solver, feature timeline, B-rep kernel, an egui UI that agents drive). This file is a router: the hard rules, then the skill to read for your task. Humans: CONTRIBUTING.md.

-## Product name
-SolidCraft everywhere: crates `solidcraft-*`, binaries `solidcraft` and `solidcraft-cli`,
-`.solidcraft` designs, the `solidcraft/N` format tag, `SOLIDCRAFT_*` environment variables,
-settings and recovery folders, the MCP server name, docs, CI and packaging. The old name
-survives only in the explicit compatibility shims listed in `docs/compatibility.md`; don't add
-new uses of it anywhere else. Public docs/web/Flatpak deployments use project Pages
-`/solidcraft/`; do not add permanent old-name Pages aliases.
+## Start here
+Work: ROADMAP.md, "Where help is wanted most" in CONTRIBUTING.md, issues labelled `help wanted`, `good first issue`, `needs-triage`; architecture in `docs/architecture.md`. Act when the code, docs and rules settle a question; ask only when it changes what users see. Local `plan/` notes are optional.

-## Start every session here
-1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md`
-   and the relevant `plan/architecture.md` section.
-2. Kernel and library decisions: `plan/adr/0001-geometry-kernel.md` (what we may depend on, what
-   is rejected for licence reasons).
-3. Follow the autonomous operation protocol (`plan/execution-plan.md` §6). Don't stop to ask
-   unless it lists the decision as the owner's.
+## Hard rules (what enforces each)
+- Independent: never copy another product's code, icons, text or templates; never drive or take data from commercial CAD. `skills/solidcraft-ground-rules/SKILL.md`.
+- No GPL/LGPL/AGPL code, not even reading it (OpenCASCADE, FreeCAD, SolveSpace, CadQuery, LibreCAD, QCAD): `cargo xtask licences --check`.
+- Every asset is original or openly licensed with a row in ATTRIBUTION.md; read `assets/AGENTS.md` before icon work: `cargo xtask assets`, `cargo xtask icons`.
+- Never crash: no unwrap/expect/panic/unsafe in non-test code (unsafe allowlist in crash-safety), errors are `Result`, input is hostile: clippy `-D warnings`, `hostile_params_never_panic`.
+- Everything is a command and programmatic calls never open dialogs: `skills/solidcraft-commands/SKILL.md`.
+- Layering (geom, sketch/kernel/render, doc, io, engine, ui-egui, apps); only `crates/kernel` uses truck: `cargo xtask layers`.
+- One outer UI container, one camera path (`navigation::handle`), colours from theme tokens: `cargo xtask ui-containers`.
+- Application code is Rust only and builds for wasm: `cargo xtask wasm`, `cargo xtask web-offline-test`.
+- The product name is SolidCraft; the old name lives only in `docs/compatibility.md`.
+- Sorted lists (message catalogs, `mod` lines, languages) stay sorted: `cargo xtask lists`. Never edit generated files (`docs/features.md`, `THIRD-PARTY-LICENSES.txt`) in a PR.
+- A design-format change is ONE new file in `crates/doc/src/format/pending/`: `scripts/test-format-pending.sh`.
+- A command has input and output schemas (will become required; `schema/unconverted.txt` only shrinks): `skills/solidcraft-commands/SKILL.md`.
+- New UI strings go in `assets/locales/pending/<slug>.json`, ATTRIBUTION rows in `attribution/pending/<slug>.md`: `cargo xtask lists`.
+- A changed default keeps the old behaviour behind a preference and fills the PR's `Changes a default:` line, and no second PR for an issue a lower-numbered one closes: `pr-checks.yml`.
+- A regression test goes in the area's existing test file, never a per-bug file (#3226).
+- Look at open PRs first, claim with a draft PR (lowest number wins), one topic per PR, never force-push `main`, no pushes just to catch up with `main`: `skills/solidcraft-contributing/SKILL.md`.
+- Show observable changes with real screenshots or a recording, captured yourself.
+- Run `cargo xtask ci` before every commit, without switching branches while it runs. `cargo xtask skills` keeps this file and `skills/` honest.

-`plan/` is gitignored (local only).
-
-## Never crash
-People trust SolidCraft with their designs; a crash loses their work. **This outranks feature work.**
- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`,
-  `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`). The exceptions, in the app crate and in
-  `crates/threedx-client` (which deny it instead), have no safe API: the macOS-only
-  `crates/threedx-client/src/macos.rs` (loads the 3Dconnexion driver's client framework at run time
-  and calls through its function pointers), two functions in
-  `apps/solidcraft/src/open_documents.rs` (macOS hands Finder files only to an Objective-C
-  method), the Windows-only `apps/solidcraft/src/native_crash.rs` (the exception filter that
-  records crashes inside native code such as graphics drivers), the Windows-only
-  `apps/solidcraft/src/native_frame.rs` (the window procedure that answers the resize-border hit
-  test of the window without OS decorations, and gives its class the icon the taskbar falls back
-  on) and the Windows-only
-  `apps/solidcraft/src/space_mouse/windows_hid.rs` (asks Plug and Play which HID interfaces are 3D
-  mice, so no other device is sent anything).
- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature
-  returns an error ("not supported yet: …"); it never panics.
- **Input-derived numbers are hostile** (command parameters, design files, control-channel
-  input): `get()` not `[i]`, finite checks, caps on sizes and loop counts.
- **Third-party kernel calls are guarded:** everything that calls `truck` goes through
-  `solidcraft_kernel::guard`, which turns a panic into `KernelError::Internal`.
- **Last-resort guard:** `Session::execute` runs every command under `catch_unwind`; an escaped
-  panic restores the design and reports `EngineError::Internal`.
- **Crash reports:** the desktop app writes every panic and every unclean exit to a local crash folder,
-  with the design and the commands that reproduce it (`solidcraft_engine::crash`, docs/crash-reports.md).
-  When someone says the app crashed, look there first: `solidcraft-cli crashes`, `crashes show <id>`,
-  `crashes replay <id>` (or the `diagnostics.crash_reports` command / MCP `crash_reports` tool).
- **Prove it:** every crash fix lands with a regression test (see `hostile_params_never_panic`); a
-  crash report's `design.solidcraft` + `replay.json` is the test's starting point.
- **Where tests go:** a regression test goes into the existing test file for its area (booleans, blends,
-  shell, sweep, STEP, naming…), never a new file named after the bug (#3226).
- Every production crate root carries
-  `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
-
-## Non-negotiables
- **Independent.** SolidCraft is independent. Behaviour is designed from public documentation,
-  general CAD conventions and user feedback. Reference tests use analytic values and open-source
-  tools. Never copy another product's code, icons, artwork, help text, tooltips, templates or
-  materials. File formats come from public specifications.
- **No commercial CAD products.** Agents must not drive, script, automate or extract data from
-  commercial CAD products (Fusion, SolidWorks, Onshape, …) for this project: no test data,
-  measurements, command lists, ids or files produced with them.
- **Never read, copy or link GPL/LGPL/AGPL code**: OpenCASCADE, FreeCAD (incl. planegcs),
-  SolveSpace, CadQuery/OCP, LibreCAD, QCAD — don't even read their sources. (`tools/freecad-oracle/`
-  runs FreeCAD as a separate program through its public scripting API to compute reference values;
-  nothing from FreeCAD is linked, vendored or shipped.) The sketch solver and the blend
-  operations are our own.
- **Assets — absolutely essential.** SolidCraft contains **no iconography, images, fonts or
-  artwork from commercial CAD products — ever.** Command icons are the original SVG masters in
-  `assets/icons/ui/design/svg/`, compiled through `crates/ui-egui/src/icon_svg.rs`.
-  **Before any icon, icon assignment or media edit, read `assets/AGENTS.md`,
-  `assets/icons/ui/AGENTS.md` and `assets/icons/ui/STYLE_GUIDE.md`.** Use the canonical
-  bases and named finished references there; never invent a parallel icon style. Any file asset must be original or openly licensed and **must have a row in ATTRIBUTION.md**
-  (`cargo xtask assets` enforces it). Screenshots of commercial CAD software are never committed.
-  Breaking this rule is the most serious mistake you can make in this repo.
- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`CommandSpec`: id = our own dotted, lower-case id `<area>.<thing>[.<variant>]` such as
-  `solid.extrude` or `sketch.rectangle.two_point`, never another product's command id; label;
-  toolbar tab and panel; icon; shortcut; params doc; `enabled`; JSON `run`) + tests. The toolbar,
-  dialogs, sketch tools, palette, scripts, CLI and control channel all reach the same commands.
- **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form; only toolbar
-  clicks (`ui.start`) start interactive tools and dialogs, which then run commands.
- **Layering** is enforced by `cargo xtask layers`: L0 `geom` → L1 `sketch`, `kernel`, `render`
-  → L2 `doc` → L3 `io` → L4 `engine` → L5 `ui-egui` → apps. Nothing below L5 depends on
-  egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.** Only `crates/kernel` may use `truck`.
- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.start(id)`. Colours come from `theme::Tokens`.
- **One outer UI container**: all panels, floating sheets, menus, overlays and platform UI
-  windows use `ui_kit::Container` (directly or through `Panel`, `Window`, `Confirm`, `Menu`).
-  Declare the semantic `Surface`; workspace panels use its shared layout policy and chrome.
-  System/report windows use `ui_kit::Window`; its low-level host builder is kit-private.
-  Do not construct raw egui hosts, outer popup/window frames or shadows in feature modules.
-  `cargo xtask ui-containers` recursively checks source/examples in all current and future crates
-  and apps. It runs in the fast repository CI job and `cargo xtask ci`, with no caller allowances.
-  See `docs/ui-container-audit.md` for the inventory and legitimate content/native exceptions.
- **One set of camera controls**: every page or canvas with a camera (viewport, Render
-  preview, future flat pattern or drawing pages) calls `navigation::handle` with its `NavCaps`
-  (orbit off for flat 2D pages). New canvases must use `navigation::handle`; never hand-roll
-  camera input (a test rejects it).
- **Application code is Rust only.** Units are millimetres and radians internally; Z is up.
-  Local asset authoring, lint and review tools use Python 3.11+ as documented in
-  `assets/AGENTS.md`; Python is not an application runtime dependency. The application exception is
-  JavaScript the browser requires: the service worker `apps/solidcraft-web/sw.js` (browsers only
-  run service workers as JavaScript) and the small inline scripts in `apps/solidcraft-web/index.html`.
-  Keep them minimal; `cargo xtask web-offline-test` covers the service worker.
- **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests,
-  assets, layers). Commit after every feature arc that builds.
- **Publishing**: the repository is github.com/tangency-labs/solidcraft. Changes land through
-  **pull requests** and the **merge queue**: push a branch and open a PR. The heavy CI jobs start
-  when a maintainer adds `approved-for-ci` after reviewing the code. Approved PRs go into the queue
-  with `gh pr merge N -R tangency-labs/solidcraft --squash --auto`; the queue runs the full suite
-  on each group before it lands on `main`. Keep each PR to one topic and one issue, and never
-  force-push `main`. Never commit `plan/`, build dirs (`target*/`) or generated reference data;
-  check `git ls-files` before pushing.
- **Never break wasm**: everything below the apps must build for `wasm32-unknown-unknown`
-  (`cargo xtask wasm`, part of `cargo xtask ci`).
-
-## Showing and following through on changes
-
- Help reviewers see what is broken or changed. For observable CAD, UI or model behavior,
-  issues and PRs must include actual descriptive screenshots or a short recording from a
-  small reproduction. This includes kernel, geometry, assembly and backend changes whose
-  effects can be shown in the app. Coding agents should run the app and capture this evidence
-  themselves; do not ask a human for evidence the agent can produce. Show the actual failure
-  or result, preferably before and after, with brief reproduction steps, expected/actual
-  behavior and annotations that point out the relevant detail.
- Flowcharts and Mermaid diagrams cannot substitute for screenshots or recordings of visible
-  behavior. Use diagrams for architectural reasoning when actual screenshots cannot illustrate
-  the point. Changes with no useful observable behavior do not need screenshot or video evidence.
- Use a small public-safe example and check for private designs, paths, account details or
-  other sensitive content before sharing. Attach media to the issue/PR or link to an accessible
-  recording; do not commit generated screenshots or videos just to provide review evidence.
- Throughout the work and before handoff, check the relevant PR's merge status. Don't push to
-  an open PR only to catch up with `main` (no merge of `main`, no Update branch, no rebase for
-  that alone): every push restarts the whole CI run, and `main`'s own run catches what lands in
-  between, to be fixed forward. When you push a change anyway, or GitHub reports a conflict,
-  rebase onto the latest `main` (push your own branch with `--force-with-lease`); never merge
-  `main` into a PR. Resolve conflicts without discarding others' work; never force-push `main`.
-  Don't re-run CI on an unchanged commit: a real failure fails again. Re-run only a job that
-  runner trouble cancelled, with "Re-run failed jobs". Report the PR state you checked and any
-  conflicts resolved. If a PR remains open, keep monitoring it while the task is active and
-  make its pending status clear at handoff; do not claim it merged without checking.
-
-## Before you start: look at what is already open
- Work with an authenticated GitHub CLI (`gh auth status`) and `git`; the checks below need both.
- Pull the whole list, not one search: `gh pr list -R tangency-labs/solidcraft --state open --limit 500`
-  (drafts included) and `gh issue list -R tangency-labs/solidcraft --state open --limit 500`. Look for
-  work on the same issue, the same feature under another number, and PRs that change the files
-  you are about to change (`gh pr list ... --json number,title,files`).
- If someone already has it, comment on their PR or issue instead of opening a second one. Two
-  PRs for one change can't both land, and one of them is wasted work and CI.
-
- Keep the `Changes a default:` line in the PR description filled in, and don't open a second PR for
-  an issue a lower-numbered open PR already closes; `pr-checks.yml` fails both (CONTRIBUTING.md, "Sending a change").
-
-## Claim = a draft PR
- Before working on issue #N, check nobody has it: `gh pr list -R tangency-labs/solidcraft --state open --search "#N"`.
- If none, branch from the latest `origin/main`, `git commit --allow-empty -m "claim: #N"`, push,
-  and open a **draft** PR titled `<summary> (#N)` right away. **The lowest-numbered open PR for an
-  issue wins**; if yours lost, close it. Opening the PR is the claim: the bot assigns you and
-  labels the issue `in progress` (or says on your PR who holds it). Reference `#N` in the PR title
-  so the bot can find it. Don't claim by editing files; comment `/claim` on the issue only to stake
-  a claim before you have a branch.
- Push work in progress at least daily. A draft with no pushes for 72 hours may be taken over:
-  comment on it first, then open your own claim (you may start from its branch).
-  This takeover policy is separate from the bot's automatic cleanup deadlines in CONTRIBUTING.md.
- On a shared build machine, check the load before a big build (`cut -d' ' -f1 /proc/loadavg`)
-  and wait while it is over 24; build with `nice`.
-
-## Design file format
-A change that saves something new in a design adds ONE file, `crates/doc/src/format/pending/<name>.rs`
-(a `//!` note, and `pub fn step` if older designs must be rewritten). Never edit `FORMAT`,
-`JSON_STEPS`, the history in `format.rs`, another change's file or a `v<N>/` folder: the build
-works out the number (the next one while anything is pending), and the release folds pending
-changes into `v<N>/` with `scripts/fold-format-pending.sh`. See CONTRIBUTING.md.
-
-## Application releases
-Development pushes are not application releases. Follow `docs/releasing.md` when asked to
-prepare or ship a release: choose the version from the actual changes, update Cargo.toml and
-Cargo.lock, pass the quality gates, advance `release` without force-pushing, and verify the
-resulting draft and its artifacts. When shipping is authorized, publish that verified draft
-and confirm its tag and downstream deployment. Do not auto-release every push to `main`, infer
-version bumps solely from commit prefixes, overwrite published versions, or push release tags
-before the draft is verified.
-
-## Running and looking at the app
- `cargo run --release -p solidcraft -- --sample --control PORT` (sample design + control channel).
-  Pick a free port. Without a display, run it under `Xvfb :99` with `DISPLAY=:99`.
- Drive it with JSON lines on `127.0.0.1:PORT` (see `docs/control-protocol.md`). The first
-  request on a connection carries the launch's token as `"token"`: read it from
-  `~/.local/share/solidcraft/control/PORT.token`, or start the app with
-  `SOLIDCRAFT_CONTROL_TOKEN=$(openssl rand -hex 32)` and send that.
-  - `{"id":1,"method":"engine.execute","params":{"command":"solid.extrude","params":{"distance":20}}}`
-  - `{"id":2,"method":"ui.start","params":{"command":"sketch.create"}}` then `ui.click {x, y}`
-  - `{"id":3,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}` then read the PNG.
- **For UI work, look at the result** (screenshot, read the PNG). Without a window use
-  `ui.render` or `solidcraft-cli snapshot`.
- Headless: `solidcraft-cli run script.json --out part.step`, `solidcraft-cli eval design.solidcraft`,
-  `solidcraft-cli snapshot script.json --out shot.png`, `solidcraft-cli commands`.
- Reference tests: `cargo xtask oracle` replays `tests/oracle/*/recipe.json` and compares with
-  each case's `expected.json` (analytic or FreeCAD values; writes `docs/oracle.md`). Expected
-  values never come from a commercial CAD product.
- Build with `CARGO_TARGET_DIR=<repo>/target`. Windows: `cargo xwin build --release --target x86_64-pc-windows-msvc -p solidcraft`.
-
-## Roadmap
-`ROADMAP.md` (committed) tracks status, milestones and estimates. Update it whenever a
-milestone task lands. `docs/features.md` (SolidCraft's commands by area, from the registry) and
-`THIRD-PARTY-LICENSES.txt` are regenerated on `main` after each merge by the Generated files
-workflow; never regenerate them in a PR.
-
-## Lists many PRs add to
-Keep them conflict-free (CONTRIBUTING.md, "Lists many changes add to"): message catalogs sorted
-(`cargo xtask lists --fix`), `mod` lines in their sorted group, the language list English first
-then by id, generated files left to `main`, and a design-format change as one new file.
-New UI strings go in a new `assets/locales/pending/<slug>.json` and new ATTRIBUTION.md rows in a new
-`attribution/pending/<slug>.md`, never into the catalogs or the table (see the README in each folder).
+## Working on X: read the skill first
+| Working on | Read |
+|---|---|
+| A PR, a claim, review, CI or evidence | `skills/solidcraft-contributing/SKILL.md` |
+| Licences, assets, clean-room, the name | `skills/solidcraft-ground-rules/SKILL.md` |
+| Non-test Rust, hostile input, a crash report | `skills/solidcraft-crash-safety/SKILL.md` |
+| A command, a crate boundary | `skills/solidcraft-commands/SKILL.md` |
+| A dialog, panel, camera, icon, colour | `skills/solidcraft-ui/SKILL.md` |
+| Labels, messages, translations | `skills/solidcraft-ui-text/SKILL.md` |
+| Saving something new in a design, import, export | `skills/solidcraft-file-formats/SKILL.md` |
+| Preferences, a changed default | `skills/solidcraft-preferences/SKILL.md` |
+| Writing or running tests | `skills/solidcraft-tests/SKILL.md` |
+| Slow work, the window thread, wasm | `skills/solidcraft-performance/SKILL.md` |
+| Releases, installers, packages | `skills/solidcraft-packaging/SKILL.md` |
+| Running the app, control channel, MCP tools | `skills/solidcraft-agent-tools/SKILL.md` |
+| Building a part over MCP | `skills/solidcraft-modeling/SKILL.md` |
+| Changing an existing design | `skills/solidcraft-editing/SKILL.md` |
+| A bug report, a crash, a wrong result | `skills/solidcraft-reporting/SKILL.md` |
+| Checking, porting, designs in git | `skills/solidcraft-checking/SKILL.md` |
+| Assemblies, joints, motion | `skills/solidcraft-mechanisms/SKILL.md` |
@@ -51,10 +51,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/app/macos/exports/icon.icns | SolidCraft contributors | macOS fallback compiled by Apple's actool from the approved assets/icons/app/macos/source/SolidCraft.icon composition | MIT OR Apache-2.0 |
 | assets/models/test_boat.bin | 3DBenchy.com | 3DBenchy.com | Public Domain |
 | assets/models/make_test_boat.py | SolidCraft contributors | original script that packs a model into the compact file above | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: two boxes bridged by `surface.blend` (a 40x10 sheet, `solidcraft-cli snapshot` of plan/evidence script ev_blend) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a saddle rim (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch through two sketch lines built by `surface.boundary` with `crown: 0.4` (`solidcraft-cli snapshot`) | MIT OR Apache-2.0 |
-| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft itself (`solidcraft --sample`) | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-blend.png | SolidCraft contributors | screenshot of SolidCraft itself: a 24 mm and a 10 mm box bridged by a `surface.blend` sheet (G1 at both edges), rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-crown.png | SolidCraft contributors | screenshot of SolidCraft itself: a patch crowned with `surface.patch crown=0.3` over a skew four-line rim, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/class-a-boundary.png | SolidCraft contributors | screenshot of SolidCraft itself: a surface through two 3D sketch splines built by `surface.boundary`, rendered by the app's `ui.render` in the dark theme with examples/demo/class_a_shots.py | MIT OR Apache-2.0 |
+| docs/screenshots/sample-plate.png | SolidCraft contributors | screenshot of SolidCraft 0.22.1 itself (`solidcraft --sample`, default dark theme, 1600x1000) | MIT OR Apache-2.0 |
 | assets/samples/exports/0.png | SolidCraft contributors | original Sample Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/1.png | SolidCraft contributors | original Sheet Metal Bracket from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/2.png | SolidCraft contributors | original Hinge Assembly from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
@@ -62,10 +62,10 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/samples/exports/4.png | SolidCraft contributors | original Bolted Flange from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/5.png | SolidCraft contributors | original Vent Plate from `crates/engine/src/sample.rs`, exported by the SolidCraft thumbnail renderer | MIT OR Apache-2.0 |
 | assets/samples/exports/scripts.json | SolidCraft contributors | SHA-256 fingerprints of the original sample scripts, generated with the shipped thumbnails | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/demo-0.8.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.8 English desktop UI modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (9× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (2× playback) | MIT OR Apache-2.0 |
-| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft desktop UI replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
+| docs/screenshots/demo.gif | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/demo.mp4 | SolidCraft contributors | original screen recording of the actual SolidCraft 0.22.1 English desktop UI (default dark theme, software renderer) modelling an original Raspberry Pi 4 case (no logos or branding; the engraved text is set in the system's DejaVu Sans Bold), generated with examples/demo/record_ui.sh and its original animated pointer overlay (6× playback, idle pauses cut) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.gif | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon (15× playback, idle pauses cut, constant-rate camera orbit) | MIT OR Apache-2.0 |
+| docs/screenshots/rover-build.mp4 | 0xlillith (model); SolidCraft contributors (recording) | screen recording of the actual SolidCraft 0.22.1 desktop UI (default dark theme, software renderer) replaying the timeline of the SELENE rover (`Rover-recorded.solidcraft` from https://github.com/0xlillith/solidcraft-rover, an original model by 0xlillith built through SolidCraft MCP); the model's lettering follows Ubuntu Light outlines (Canonical Ltd., Ubuntu Font Licence 1.0, as noted in that repository); the emblem is the SolidCraft project icon | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-floating.png | SolidCraft contributors | original UX mockup (Model tab, floating layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/model-compact.png | SolidCraft contributors | original UX mockup (Model tab, compact docked layout) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
 | docs/design/ux-redesign/sketch.png | SolidCraft contributors | original UX mockup (Sketch tab) rendered from an HTML mockup that uses the original Technical Accent icon set; no third-party artwork, and not a screenshot of any other CAD product | MIT OR Apache-2.0 |
@@ -128,14 +128,14 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/fonts/ibm-plex-mono/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/ibm-plex-sans/OFL.txt | IBM Corp. | Unmodified accompanying font licence | SIL OFL 1.1 |
 | assets/fonts/liberation-sans/OFL.txt | Red Hat, Inc.; Liberation Fonts contributors | Unmodified accompanying font licence | SIL OFL 1.1 |
-| assets/icons/app/linux/exports/hicolor/128x128/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/16x16/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/24x24/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/48x48/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
-| assets/icons/app/linux/exports/hicolor/64x64/apps/ai.storyteller.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/128x128/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/16x16/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/24x24/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/48x48/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
+| assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/app_icon.rs | SolidCraft contributors | Original SolidCraft drawing code: the borderless mark, drawn from the faces and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg | MIT OR Apache-2.0 |
 | assets/icons/app/shared/source/windows_ico.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/icons/app/windows/exports/solidcraft-executable.ico | SolidCraft contributors | Generated from assets/icons/app/shared/source/app_icon.rs with the original CLI/ICO encoders | MIT OR Apache-2.0 |
@@ -158,6 +158,7 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/locales/ja.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ko.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/ms.json | A.Hakim (a-hakim) | Malay translation of the English message catalog | MIT OR Apache-2.0 |
+| assets/locales/nb.json | SolidCraft contributors | Original Norwegian Bokmål translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/nl.json | SolidCraft contributors | Original Dutch translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/locales/pl.json | cyryllo | Polish translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
 | assets/locales/ru.json | Alex Pro (del000) | Russian translation of the English catalog, contributed upstream | MIT OR Apache-2.0 |
@@ -170,9 +171,13 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/locales/zh.json | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | assets/locales/zh-TW.json | SolidCraft contributors | Original Traditional Chinese (Taiwan) translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
 | assets/materials/library.rs | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
-| assets/platforms/linux/ai.storyteller.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.desktop | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.metainfo.xml.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/linux/io.tangencylabs.solidcraft.mime.xml | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
+| assets/platforms/macos/dmg/background.tiff | SolidCraft contributors | original disk image window background (blueprint sheet: grid, double border, circles, centre lines, leader arrow, title block) drawn by assets/platforms/macos/dmg/make_background.py in IBM Plex Sans/Mono; 1x and 2x representations | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/make_background.py | SolidCraft contributors | authoring script that draws the disk image background (Pillow); not part of any build | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/layout.json | SolidCraft contributors | disk image window size, icon size and icon positions shared by the background script and settings.py | MIT OR Apache-2.0 |
+| assets/platforms/macos/dmg/settings.py | SolidCraft contributors | dmgbuild settings (MIT, https://github.com/dmgbuild/dmgbuild) for the SolidCraft disk image; original settings, no dmgbuild code copied | MIT OR Apache-2.0 |
 | assets/platforms/macos/Info.plist.in | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/macos/README.txt | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
 | assets/platforms/windows/solidcraft.en-us.wxl | PhotoCraft / SolidCraft contributors | PhotoCraft packaging templates (https://github.com/storytold/photocraft), adapted for SolidCraft | Apache-2.0 |
@@ -199,6 +204,8 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/styles/ui/themes/graphite.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/nosferatu.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Dracula by Zeno Rocha and the Dracula Theme contributors, https://github.com/dracula/dracula-theme, MIT) | MIT OR Apache-2.0 |
 | assets/styles/ui/themes/catppuccin-mocha.json | SolidCraft contributors | original SolidCraft theme file adapting the colours of a published palette (Catppuccin by the Catppuccin organisation, https://github.com/catppuccin/catppuccin, MIT) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/okibi.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Okibi palette (dark) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/akari.json | SolidCraft contributors (Kai Evans) | original SolidCraft theme file mapping SolidCraft's UI colours to the Akari palette (light) of the Okibi design system by Kai Evans (https://kaievns.github.io/okibi-akiri-design-system-spec/) | MIT OR Apache-2.0 |
 | assets/styles/web/loading-logo.svg | SolidCraft contributors | Animation of the SolidCraft mark, built from the paths and gradients of assets/icons/app/macos/source/SolidCraft.icon/Assets/03-solid-blue-cutout.svg; original animation | MIT OR Apache-2.0 |
 | assets/styles/web/loading.css | SolidCraft contributors | Original SolidCraft resource data or drawing code, collected without redesign | MIT OR Apache-2.0 |
 | crates/io/src/native_cad/fixtures/block.FCStd | SolidCraft contributors | original 10 × 20 × 30 mm test box saved by FreeCAD 1.1.4 run as an external program (`make_block_fcstd.py` beside it); no third-party geometry | MIT OR Apache-2.0 |
@@ -281,8 +288,57 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/model/circle_tt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/circle_ttt.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/coil.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/colored_components_off.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/combine.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/component.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
+
+### Render workspace icon drafts
+
+Original SolidCraft drawings, Open for owner review; no runtime assignments.
+
+| File | Author | Source | Licence |
+|---|---|---|---|
+| assets/icons/ui/design/svg/model/render_all_shots.svg | SolidCraft contributors | original Camera icon master (64 grid): stacked camera bodies with a lower-right play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_appearance.svg | SolidCraft contributors | original Looks icon master (64 grid): shaded look sphere on the top corner of an accent-shaded cube | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_aspect_frame.svg | SolidCraft contributors | original Camera icon master (64 grid): wide rounded frame with two opposite corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_backdrop.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube in front of a tall upright accent panel | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_cancel.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round stop badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_check.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round check badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_compare.svg | SolidCraft contributors | original Output icon master (64 grid): two grey pictures split by a vertical slider with opposed arrows | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_copy_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere in a square frame offset from a second frame outline | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_execute.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a lower-right round play badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_export_image.svg | SolidCraft contributors | original Output icon master (64 grid): picture with a large outward diagonal arrow at the upper right | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_exposure.svg | SolidCraft contributors | original Camera icon master (64 grid): split light and accent disc with plus and minus marks | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_fit_product.svg | SolidCraft contributors | original Camera icon master (64 grid): grey cube inside four corner brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_frame_guides.svg | SolidCraft contributors | original Camera icon master (64 grid): rounded frame with a rule-of-thirds grid and four accent nodes | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_from_material.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere struck through above a plain grey slab | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_ground.svg | SolidCraft contributors | original Studio icon master (64 grid): grey cube on a slab with an accent contact patch | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lens.svg | SolidCraft contributors | original Camera icon master (64 grid): concentric lens rings around an accent centre | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_library.svg | SolidCraft contributors | original Studio icon master (64 grid): row of three look spheres, middle one accent, on a shelf bar | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_area.svg | SolidCraft contributors | original Lights icon master (64 grid): slanted flat panel above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_by_highlight.svg | SolidCraft contributors | original Lights icon master (64 grid): shaded sphere with a ringed highlight target and dotted stem arriving from above | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_point.svg | SolidCraft contributors | original Lights icon master (64 grid): round source disc with centre dot above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_light_spot.svg | SolidCraft contributors | original Lights icon master (64 grid): cone source with curved rim above a dotted accent stem | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_lighting_presets.svg | SolidCraft contributors | original Studio icon master (64 grid): two stacked cards, the front one holding a light bulb | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_output_size.svg | SolidCraft contributors | original Output icon master (64 grid): picture frame with a diagonal double-headed dimension arrow | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_paint.svg | SolidCraft contributors | original Looks icon master (64 grid): flat brush with an accent tip, light ferrule and slate handle | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_pick_up.svg | SolidCraft contributors | original Looks icon master (64 grid): eyedropper with a grey bulb, slate crossbar and accent sampling tip | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_quality.svg | SolidCraft contributors | original Output icon master (64 grid): three rising bars, the tallest in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_replace_all.svg | SolidCraft contributors | original Looks icon master (64 grid): grey sample sphere with an arrow to an accent sphere beside a second one | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_results.svg | SolidCraft contributors | original Output icon master (64 grid): stack of two pictures, the front one showing a landscape | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_same_look.svg | SolidCraft contributors | original Looks icon master (64 grid): look sphere and three cubes, the two matching cubes ringed | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right plus badge | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_shots_strip.svg | SolidCraft contributors | original Camera icon master (64 grid): strip of three small frames, the middle one in accent | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_solo_light.svg | SolidCraft contributors | original Lights icon master (64 grid): point source and dotted stem inside four corner focus brackets | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_sun.svg | SolidCraft contributors | original Lights icon master (64 grid): source disc with eight short radial rays | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_transparent_background.svg | SolidCraft contributors | original Output icon master (64 grid): grey cube on a checker tile | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_update_shot.svg | SolidCraft contributors | original Camera icon master (64 grid): camera body with a lower-right refresh badge | MIT OR Apache-2.0 |
+
+### UI icon masters (continued)
+
+| File | Author | Source | Licence |
+|---|---|---|---|
 | assets/icons/ui/design/svg/model/compute.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/configuration_table.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/conic.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -372,6 +428,21 @@ Editable drawing code, native projects and shipped exports are collected under `
 | assets/icons/ui/design/svg/flat/shield.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/status_recovery.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/frame_member.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/render_environment.svg | SolidCraft contributors | original Studio icon master (64 grid): dome with a grey cube inside | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_shaded.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_wireframe.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_hidden_edges.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/style_translucent.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_faces_edges.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_bodies.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_features.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_parts.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_components.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/select_sketch.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/display.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/grid.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/ground_shadow.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/flat/ambient_occlusion.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/placeholder.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
 | assets/icons/ui/design/svg/model/plane_angle.svg | SolidCraft contributors | two-tone modelling icon master (64 grid), original SolidCraft artwork | MIT OR Apache-2.0 |
@@ -514,6 +585,18 @@ Editable drawing code, native projects and shipped exports are collected under `
 | docs/book/src/og.png | SolidCraft contributors | copy of assets/branding/web/source/og.png staged by cargo xtask book (gitignored) | MIT OR Apache-2.0 |
 | docs/sponsors/blacksmith-ci-powered.png | Blacksmith (blacksmith.sh) | "CI powered by Blacksmith" sponsor banner supplied by Blacksmith for the sponsorship credit; used only to credit the sponsor, not part of the application | © Blacksmith, used with permission |
 | assets/icons/ui/design/svg/model/path_flange.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| docs/book/src/generated/hem.png | SolidCraft contributors | rendered by `cargo xtask book` (`solidcraft-cli snapshot docs/book/scripts/hem.json`; gitignored), original sheet metal demonstration | MIT OR Apache-2.0 |
+| docs/book/scripts/hem.json | SolidCraft contributors | original parametric recipe for an 80 × 50 mm sheet with an 8 mm returned edge, authored for the command guide | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay.json | SolidCraft contributors | original SolidCraft theme file (Clay, light): warm paper palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/clay-dark.json | SolidCraft contributors | original SolidCraft theme file (Clay Dark): warm charcoal palette chosen for SolidCraft | MIT OR Apache-2.0 |
+| assets/icons/ui/design/svg/model/cone.svg | SolidCraft contributors | original icon master (64 grid) | MIT OR Apache-2.0 |
+| assets/locales/ar.json | Abdullah (A-AL-ANAZI) | Original Arabic translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/locales/he.json | SolidCraft contributors | Original Hebrew translation of SolidCraft's English catalog; no commercial CAD text used | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/cga.json | SolidCraft contributors | original SolidCraft theme file using the 16 colours of the IBM Color Graphics Adapter (black, cyan, magenta, and white of its high-intensity palette 1 for the interface) | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| assets/styles/ui/themes/1-bit-dark.json | SolidCraft contributors | original SolidCraft theme file | MIT OR Apache-2.0 |
+| `assets/locales/pending/navbar-customisation.json` | SolidCraft contributors | Original navigation bar editor translations | MIT OR Apache-2.0 |
+| `assets/locales/pending/navbar-slots.json` | SolidCraft contributors | Original navigation slot translations | MIT OR Apache-2.0 |

 ## Code adapted from sibling projects

@@ -1,8 +1,10 @@
 # Contributing to SolidCraft

+Agents: start from the router in [AGENTS.md](AGENTS.md), which points to a short skill in [`skills/`](skills/README.md) for each kind of work. This page stays the full human guide.
+
 SolidCraft is an open-source parametric 3D CAD app written in pure Rust.
 You sketch on a plane, constrain the sketch, turn profiles into solids, and
-change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, Linux), in
+change a parameter to watch the timeline rebuild. It runs as a desktop app (Windows, macOS, Linux), in
 the browser (wasm + WebGPU/WebGL2), headless from a CLI, and as an MCP server that AI agents can
 model with.

@@ -11,7 +13,7 @@ build it, how the code is laid out, the few rules that aren't negotiable, and wh
 needed most.

 Before choosing a task, check the [command inventory](docs/features.md) and
-[roadmap](ROADMAP.md) for implemented capabilities and current priorities.
+[roadmap](docs/roadmap-detail.md) for implemented capabilities and current priorities.

 Questions, ideas or want to say what you're working on? Join the [Discord](https://discord.gg/FtU4NQNVDH).

@@ -130,8 +132,11 @@ The [architecture page](docs/architecture.md) has the layer table. The short ver
   - Every call into truck goes through `solidcraft_kernel::guard`.
   - Every crash fix comes with a regression test.
 5. **Everything is a command, with a test.** A new feature means a `CommandSpec` in
-   `crates/engine/src/cmd/`, engine tests that measure the result (volume, area,
+   `crates/engine/src/cmd/` with input and output schemas (see
+   [Adding a command](docs/book/src/dev/commands.md#adding-a-command); a test warns about a
+   command without them, and will fail it once required), engine tests that measure the result (volume, area,
   face/edge/vertex counts against a value you can derive), and for UI work a scenario (below).
+   A command on the toolbar also ships with its help tooltip (step 6 of Adding a command).
 6. **One set of camera controls.** Every page or canvas that shows a view (the modelling
   viewport, the Render preview, and any new page such as a flat pattern or drawing) calls
   `navigation::handle` (`crates/ui-egui/src/navigation.rs`) for its camera input, with
@@ -190,9 +195,11 @@ in the PR. `cargo xtask test` builds the tests with it and then runs every test
 shared bound on top-level test/side commands for `cargo xtask test` and `cargo xtask ci`.
 For example, `SOLIDCRAFT_TEST_JOBS=2` allows two commands at once; the sequential wasm/doc
 worker consumes one of those slots. Every binary and side check still runs after failures.
-Without the variable the existing concurrency is unchanged. `RUST_TEST_THREADS`,
-`ACTION_MATRIX_JOBS` and Cargo's build-job setting remain independent caller overrides;
-this limit does not choose their values or change test filters, timeouts or baselines.
+Without the variable the existing concurrency is unchanged. With it set, each test binary
+inherits `RUST_TEST_THREADS` and `ACTION_MATRIX_JOBS` of `max(1, cpus / jobs)` — the machine's
+parallelism shared between the binaries in flight — unless you set either one explicitly;
+explicit caller overrides always win. Cargo's build-job setting remains an independent caller
+override; this limit does not change test filters, timeouts or baselines.
 Tests run beside each other on a busy machine, so a test must not depend on wall-clock timing.

 **Ready pull requests test what they touch.** CI maps changed files to workspace packages and
@@ -274,6 +281,15 @@ and a fresh CI run:
  and the Lists workflow) fails on an unsorted catalog or an id that appears twice.
 - **`mod` lines**: one per line, in the sorted group they belong to (`cargo fmt` keeps each group
  sorted). Add a new module into the existing group, not as a new group at the end.
+- **Commands without schemas** (`crates/engine/src/schema/unconverted.txt`): sorted, one id per
+  line, and it only shrinks. Converting a command removes its line; a new command is never added
+  to it.
+- **Toolbar commands without help** (`BACKLOG` in `crates/ui-egui/src/command_help.rs`): sorted,
+  one id per line, and it only shrinks. Writing a command's help removes its line; a new command
+  is never added to it.
+- **`ui.prefs` settings** (`docs/control-protocol.md`): one line per setting, sorted by name, in
+  the list under the protocol table; add a new setting on its own line rather than editing a shared
+  row.
 - **Languages** (`crates/ui-egui/src/i18n.rs`): one per line, English first, then by id (a test
  checks it).
 - **Generated files**: `THIRD-PARTY-LICENSES.txt` and `docs/features.md` are rewritten on `main`
@@ -334,6 +350,16 @@ Changes with no useful observable behavior do not need screenshot or video evide
 small example without private designs or sensitive details; attach the media or link to an
 accessible recording rather than committing generated review artifacts.

+To show a picture without committing it, attach the media to the PR (it goes to the PR's own
+attachment storage and renders inline in the comment). A gist is the better home for a log or
+another text file, and you link it; a gist does not render a picture inline. The review artifacts
+stay out of the diff that way, and nothing has to be pushed to a branch of its own.
+
+Attaching works in the browser for anyone who can comment: drag the file into a comment on the
+pull request. A command-line agent without a browser session usually cannot attach a file (the
+upload needs write access to this repository). Say so in the pull request, and the person running
+the agent or a maintainer can attach it.
+
 Keep an eye on your PR's status, but don't push to it only to catch up with `main` (no merge of
 `main`, no Update branch button, no rebase for that alone): every push restarts the whole CI
 run for everyone waiting behind it, and `main`'s own run catches what lands in between. When you
@@ -389,7 +415,7 @@ In order of how much they'd help users:
 2. **Boolean robustness.** A random-design fuzzer currently gets about half of its designs
   through without a kernel error. Each failing seed is a reproducible bug.
 3. **Drawings, CAM and mesh tools.** These are out of scope for now (see
-   [ROADMAP.md](ROADMAP.md)), but anyone who wants to own one is welcome.
+   [ROADMAP.md](docs/roadmap-detail.md)), but anyone who wants to own one is welcome.

 ## Updating the generated feature list

@@ -4208,7 +4208,7 @@ dependencies = [

 [[package]]
 name = "solidcraft"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "block2 0.6.2",
 "eframe",
@@ -4217,6 +4217,7 @@ dependencies = [
 "getrandom 0.3.4",
 "hidapi",
 "keyring",
+ "libc",
 "log",
 "muda",
 "objc2 0.6.5",
@@ -4228,6 +4229,7 @@ dependencies = [
 "rfd",
 "ron",
 "rustls",
+ "serde",
 "serde_json",
 "solidcraft-3dx-client",
 "solidcraft-engine",
@@ -4240,11 +4242,11 @@ dependencies = [

 [[package]]
 name = "solidcraft-3dx-client"
-version = "0.22.1"
+version = "0.25.1"

 [[package]]
 name = "solidcraft-cli"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "image",
 "log",
@@ -4256,7 +4258,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-derive"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4265,7 +4267,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-doc"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "log",
 "serde",
@@ -4282,8 +4284,9 @@ dependencies = [

 [[package]]
 name = "solidcraft-engine"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
+ "image",
 "log",
 "schemars",
 "serde",
@@ -4302,7 +4305,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-geom"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "serde",
 "serde_json",
@@ -4311,7 +4314,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-gpu"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "image",
 "log",
@@ -4331,7 +4334,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-io"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "cadmpeg-core",
 "cadmpeg-ir",
@@ -4355,7 +4358,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-kernel"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "log",
 "proptest",
@@ -4375,7 +4378,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-mcp"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "serde_json",
 "solidcraft-engine",
@@ -4384,7 +4387,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-render"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "image",
 "moxcms",
@@ -4398,7 +4401,7 @@ dependencies = [

 [[package]]
 name = "solidcraft-sketch"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "serde",
 "serde_json",
@@ -4409,14 +4412,14 @@ dependencies = [

 [[package]]
 name = "solidcraft-space-mouse"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "solidcraft-ui-egui"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "arboard",
 "egui",
@@ -4438,6 +4441,7 @@ dependencies = [
 "tiny-skia",
 "toml",
 "ttf-parser",
+ "unicode-bidi",
 "web-time",
 "winreg",
 "zip",
@@ -4445,15 +4449,17 @@ dependencies = [

 [[package]]
 name = "solidcraft-web"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "eframe",
 "egui",
 "js-sys",
 "log",
+ "percent-encoding",
 "serde_json",
 "solidcraft-engine",
 "solidcraft-ui-egui",
+ "url",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -4945,6 +4951,12 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"

+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-general-category"
 version = "1.1.0"
@@ -5982,12 +5994,15 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.22.1"
+version = "0.25.1"
 dependencies = [
 "proc-macro2",
+ "serde",
 "serde_json",
 "sha2 0.10.9",
 "syn 2.0.119",
+ "toml",
+ "zip",
 ]

 [[package]]
@@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"]
 exclude = ["vendor"]

 [workspace.package]
-version = "0.22.1"
+version = "0.25.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -0,0 +1,44 @@
+# Disclaimer
+
+This disclaimer covers the software, models, data, documentation and every other file in this
+repository and in the releases built from it (together, "the files").
+
+## No warranty
+
+The files are provided "as is", without warranty of any kind, express or implied, including
+warranties of accuracy, merchantability, fitness for a particular purpose and non-infringement.
+Results produced with the files, such as geometry, meshes, analyses and simulations, can be
+wrong. A qualified person must check them before anyone relies on them for a design,
+manufacturing or safety decision.
+
+## No liability
+
+To the fullest extent permitted by law, Tangency Labs and the contributors are not liable for any
+claim, damage, loss or other liability arising from the files or from their use, modification or
+distribution, whether in contract, tort or otherwise.
+
+## No indemnity
+
+Neither Tangency Labs nor any contributor indemnifies, defends or holds harmless anyone who uses,
+modifies or distributes the files, including against claims that the files infringe someone
+else's rights.
+
+## Harmful or unlawful use
+
+Tangency Labs and the contributors do not authorise, endorse or accept any responsibility for use
+of the files to harm people, animals, property or the environment, or for any unlawful use.
+Whoever uses the files is solely responsible for how they use them, for what they make with them
+and for complying with the laws that apply to them. Tangency Labs and the contributors must not be
+named or held out as responsible for any such use.
+
+## No endorsement
+
+Using, modifying or distributing the files does not mean that Tangency Labs or any contributor
+endorses you, your product or your results. Do not use the name of Tangency Labs or of a
+contributor to suggest such an endorsement without written permission.
+
+## Relation to the licence
+
+This disclaimer adds to the warranty and liability terms of the licence the files are distributed
+under. It does not restrict any right that licence grants; where the two differ, the licence
+governs.
@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" width="96" height="96" alt="SolidCraft" />
+  <img src="assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" width="96" height="96" alt="SolidCraft" />
 </p>

 <h1 align="center">SolidCraft</h1>
@@ -46,13 +46,13 @@
  <a href="https://trendshift.io/repositories/296178?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-296178" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/296178/daily?language=Rust" alt="tangency-labs%2Fsolidcraft | Trendshift (Rust)" width="250" height="55"/></a>
 </p>

-![SolidCraft 0.8: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo-0.8.gif)
+![SolidCraft: model a Raspberry Pi 4 case from an empty design: a sketch dimensioned with parameters, extrude, fillets and shell, a rim rounded in one pick, standoffs patterned on the board's mounting holes, port cut-outs, vent slots, "Pi 4" engraved in a font, a PETG material with its mass in Properties, and a height change in Parameters](docs/screenshots/demo.gif)

-*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 9× playback. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo-0.8.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*
+*A Raspberry Pi 4 case from an empty design: a sketch dimensioned with the board's parameters, extrude, fillet, shell, the rim rounded in one pick, an M2.5 standoff patterned on the 58 × 49 mm hole rectangle, port cut-outs, vent slots, "Pi 4" engraved in DejaVu Sans Bold and a PETG material defined in the design, with its mass in Properties, then height 24 → 32 mm in Parameters and it all rebuilds. 6× playback with the idle pauses cut. [Full video](https://github.com/tangency-labs/solidcraft/raw/refs/heads/main/docs/screenshots/demo.mp4), recorded with the [demo script](examples/demo/record_ui.sh).*

 ## Download

- **Windows:** the [installer][windows-msi], or `winget install bherbruck.SolidCraft`.
+- **Windows:** the [installer][windows-msi].
 - **macOS:** the [disk image][macos-dmg] (Apple silicon and Intel).
 - **Linux:** the [AppImage][linux-appimage], or `sudo snap install solidcraft` ([Snap Store][snap-store]).
 - **Web:** [try it in your browser][web-app], no install.
@@ -74,7 +74,7 @@ other is a tracked bug.
 - **Parameters and configurations** with unit-aware expressions.
 - **Assemblies** with joints, motion studies, contact sets, interference and mass properties.
 - **Sheet metal** with flanges, hems, fold/unfold and flat patterns, and plastic enclosure features.
- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.solidcraft` designs.
+- **Files:** STEP, IGES, 3MF, STL, OBJ and glTF in and out where supported, URDF export, `.sc` designs (`.solidcraft` files from earlier releases still open).
 - **Desktop app, browser app, headless CLI and MCP server**, all running the same commands.

 The full list is in [docs/capabilities.md](docs/capabilities.md) and [docs/features.md](docs/features.md);
@@ -96,8 +96,10 @@ More commands, the Windows cross-build and the browser build are in [docs/buildi

 `solidcraft-cli mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server. Headless it
 runs its own design session, or with `--connect` it drives the running app so you can watch.
-Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. Tools, access rules and an
-example session: [docs/mcp.md](docs/mcp.md).
+Claude Code: `claude mcp add solidcraft -- solidcraft-cli mcp`. If a terminal doesn't find
+`solidcraft-cli` (older Windows installers don't put it on `PATH`), give its full path (by default
+`"C:\Program Files\SolidCraft\solidcraft-cli.exe"`). Tools, access rules and an example session:
+[docs/mcp.md](docs/mcp.md).

 ## Scripts

@@ -119,11 +121,18 @@ the clean-room and licence rules, and where help is wanted most. Open work is in
 SolidCraft's continuous integration runs on [Blacksmith](https://www.blacksmith.sh), which
 sponsors its CI minutes.

+## Disclaimer
+
+The files in this repository are provided as is, without warranty, liability or indemnity, and
+Tangency Labs and the contributors accept no responsibility for any harmful or unlawful use of
+them: read [DISCLAIMER.md](DISCLAIMER.md).
+
 ## Licence

 MIT OR Apache-2.0, at your option. Developed under the
 [clean-room contribution rules](AGENTS.md); third-party code and assets retain their
-documented licences and attribution.
+documented licences and attribution. The licence covers the code, not the name and logo: see
+[TRADEMARKS.md](TRADEMARKS.md) for how to name a fork or a product built on SolidCraft.

 SolidCraft is independent. Behaviour is designed from public documentation, general CAD
 conventions and user feedback. Reference tests use analytic values and open-source tools.
@@ -1,696 +1,82 @@
 # SolidCraft roadmap

-Status as of **2026-10-14**. SolidCraft supports parametric modelling (sketch →
-features → parametric timeline) as an open, pure-Rust, agent-drivable application.
-
-## At a glance
-
-| Question | Answer |
-|---|---|
-| Where are we? | **M0 and M13 done; M1, M2, M5–M7, M9, M10, M14 in progress.** Sketch with solver and the full SKETCH create/modify set; extrude, revolve (two sides, symmetric, to object), fillet/chamfer (variable radius, chord length, a radius per edge, corner patches), holes, threads (cosmetic and modelled), patterns, mirror, shell (inside/outside/both), draft, loft, sweep, coil, split body and split face, delete face, construction planes, axes and points; persistent naming of faces and edges; parameters and configurations; components, joints, motion studies, exploded views; sheet metal and a plastic enclosure subset; STEP/IGES/3MF/STL/OBJ/DXF; FreeCAD/Rhino import; autosave and crash recovery; desktop and browser (wasm) app, CLI, MCP server. |
-| Features | Every registered command by area — [docs/features.md](docs/features.md) (`cargo xtask features`); registry breadth does not establish workflow or geometric depth |
-| Reference tests | [Current case count and results](docs/oracle.md): public cases in `tests/oracle/` with analytic or FreeCAD-computed expected values, checked by the reference-test job in [CI](.github/workflows/ci.yml). |
-| Tests | Solver, profiles, kernel booleans/blends/measures, expressions, timeline, persistent naming, file formats and migrations, assemblies, sheet metal, engine end-to-end, hostile-input fuzz over every command and headless UI scenarios. `cargo xtask ci` reports the current passing counts. |
-| Gates | `cargo xtask ci`: fmt, clippy -D warnings, tests, asset attribution, layering, wasm32 build — green |
-| Time to a useful alpha (M0–M6) | ≈ **82 agent hours** remain (sum of the M1–M6 estimates below) |
-
-Optional GPU viewport ambient occlusion is available in View settings and Graphics preferences,
-with persistent settings, Performance/Quality graphics presets (Quality combines AO, Fine tessellation and adaptive 2× supersampling; manual combinations show Custom), and the
-`view.ambient_occlusion` and `view.graphics_preset` commands. See [display settings](docs/ambient-occlusion.md).
-
-## Scope (owner decision, 2026-10-07)
-
-The issue batch adds preservation of blind pockets in through cuts, associative projected
-offsets and plastic face placements, XZ (+Y normal) with a v6 migration preserving older
-designs, interactive angle placement, file-picker sketch imports, Home/recent controls,
-toolbar overflow, and the remaining component-frame and assembly WIP work. The enclosure
-acceptance scenarios now include board resizes; STEP reopening is automated. See [WIP reconciliation](docs/wip-reconciliation.md).
-Face-based Extrude Join (including outward Press Pull) now defaults to the picked body,
-so edge-touching assembly neighbours stay separate regardless of body order (#226).
-
-In scope, in priority order:
-1. SOLID and SKETCH (now).
-2. Parameters / functional constraints (done: see `parameters.*`, `expr.evaluate`; unit-aware,
-   cycles reported with their path, rename follows references, deletes list their users):
-   user parameters with units and expressions (+-*/, ^,
-   parentheses, sin/cos/sqrt/min/max/floor/ceil/round, unit conversion), model parameters
-   d1, d2… for every dimension and feature input, references between parameters with a
-   dependency graph and cycle detection, re-evaluation on change, comments, favourites,
-   CSV/JSON import and export.
-3. Components and assemblies with joints (M9).
-4. SHEET METAL: flange, contour flange, bend, unfold/refold, flat pattern with DXF export, sheet
-   metal rules (thickness, K-factor, bend radius) (M10).
-5. A small PLASTIC subset for enclosures, after sheet metal: Boss, Rib, Web, Lip/Groove, Snap Fit.
-
-Deferred until further notice: MESH, FORM (T-splines), SURFACE beyond what solids need (scope proposed in #772), PCB / 3D
-PCB / Package, Render, Animation, Simulation, Manufacture/CAM, Drawings.
-
-## Milestones
-
-| # | Milestone | Status | Hours left |
-|---|---|---|---|
-| M0 | Vertical slice | done | — |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
-| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces, at distances from reference edges, and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M1 | Sketch depth: command coverage implemented — projection/intersect/include as linked geometry (auto-project on faces, lost-reference warnings, break link), full SKETCH create/modify set (slots, polygons, tangent arcs/circles, ellipse, fit/control splines, conic, text, trim/extend/break, fillet/chamfer, offset, mirror, patterns, move/scale, blend curve, centerline), constraints incl. curvature and polygon with over-constraint refusal, Shift-picked line midpoints in Horizontal/Vertical using persisted points and ordinary constraints (#2087), drawing snaps to where two lines, circles or arcs cross (#4967), driven/arc-length/linear-diameter dimensions, AutoConstrain, DXF/SVG insert, 3D sketch curves (Project To Surface, Intersection Curve, Isoparametric Curve, Spun Profile), exact free-form profiles (B-spline/NURBS edges, any spline degree, curves cut by crossings), sweeps and pipes along 3D sketch curves, canvases and decals, curvature combs. Exact free-form Extend and certified associative offsets now preserve geometry and IDs through edits, deletion and reopen. Occurrence-frame 3D wires now store explicit coordinate spaces and retain points and analytic fits through moves, refresh, undo and reopen. Constructive sketch solving (Owen 1991, Fudos & Hoffmann 1997) ahead of the numerical solver: points and rigid clusters are placed on the branch the sketch had, so dimension edits and drags keep their solution; edits that would turn a sketch over are refused; drags re-solve only the sketch per frame. Remaining workflow repairs: mixed offset junctions, legacy natural-spline seams, and damaged legacy wire links lacking frame provenance | in progress | 4 |
-| M2 | Robust modelling: coplanar booleans in the kernel, holes (placed on faces and on sketch points), threads (cosmetic, then modelled), patterns, mirror, shell, draft, split, construction geometry | in progress | 16 |
-| M3 | General fillets and chamfers (curved edges, chains, vertex blends); saddle rolling-ball surfaces now use continuous seam sections and arc-length fitting with shared contact boundaries and bounded accuracy checks; tiny rim edges remain selected instead of nearby wall seams when filleting (#2498) | in progress | 30 |
-| M4 | Files: STEP import (done — [docs/step-import.md](docs/step-import.md)), FreeCAD/Rhino solids through cadmpeg (done, desktop, browser and CLI), 3MF export and 3MF/STL import as mesh bodies (done), 3MF with B-rep face tags ([docs/formats/3mf-face-tags.md](docs/formats/3mf-face-tags.md), done), constant-section parametric mesh reconstruction, DXF sketches, OBJ import | in progress | 6 |
-| M5 | Persistent naming of faces and edges (docs/book/src/dev/naming.md): faces named from their exact kernel-reported history (sketch curve sides, caps, revolve sections, primitive sides, blends, shell inner walls, pattern/mirror copies; split pieces told apart by the faces around them, lumps of a cut body named after their faces), edges by their faces; fillets/chamfers, sketches on faces, shell/draft/offset/replace faces, hole placements, joint origins and face appearances resolve by name first and warn when the entity split or vanished: done. sheet metal edges by base sketch line and flange side, shell inner faces, sweep and loft roles: done. kernel-reported face history: done (merged faces answer to every name; operations without history yet fall back to geometric names, flagged unverified; format 14 keeps older designs' geometric names). Left: history through sheet metal, plastic, surface and emboss features; FaceSource certificates through history | in progress | 20 |
-| M6 | UI depth: selection feedback and origin (done), timeline editing (done: hover and selection highlight modifier faces, including fillets and chamfers; edit feature, history marker drag, dependency-checked single and multi-item reorder, suppress, rename, delete with dependents, re-resolved references; redefining selections refreshes persistent edge/face references while retaining feature identity and dimension names; responsive feature history with width-driven icons/names/title, snapping width resize, bottom/left/browser-stack docking, shared-column collapse, rollback bar, multi-selection and persistent folders), right-docked dialogs (done), live previews for every feature dialog (done), keyboard-first commands with on-canvas value boxes and sketch inline dimensions (done), drag manipulators with automatic join/cut (done: extrude incl. two sides, fillet, shell, hole depth, move, pattern spacing, revolve rotator, extrude taper), dark theme (done), right-click menu with Repeat (done), measure tool (done), section analysis (done), selection filter (done), drag-solve of sketch points (done); appearance controls now preserve body/face/component targeting, named transparent looks, reuse/search and override removal; Browser Expand All / Collapse All (`browser.expand_all`, `browser.collapse_all`) on the design and component menus; preferences | in progress | 6 |
-| M7 | Thin extrude (walls along open or closed curves: centre, inside, outside or two sides; mitred corners, crossing walls joined; #721), sweep, loft (incl. to a point), rib and web (to next / depth), emboss (planar faces and exact radial emboss/deboss of bounded orthogonal profiles on complete exterior cylinders/sleeves), thread (cosmetic, and modelled M3–M20 outside and inside: the ISO profile screwed in as a faceted cut), coil (smooth B-spline helical walls), pipe, pattern on path, patterns of bodies and components, replace face (parallel), align, remove, feature copy/paste: done. Unique eligible cylindrical targets are inferred for new Emboss features. Left: general curved-face emboss and exact (unfaceted) modelled threads | in progress | 12 |
-| M8 | Surface workspace (#772). Done: Patch (sketch regions; edge loops filled G0, plus `crown`), Stitch, Thicken (planes and cylinders), Extend (straight edges of planar surfaces), Trim (by a plane, a face or sketch curves swept onto the surface, keeping a side or the picked regions; mutual trim of two surfaces, extended to meet and stitched, #767), Delete Face (healing), Boundary Fill, zebra/draft/curvature-map analysis, Surface Extrude/Revolve/Sweep/Loft from open and closed curves, Offset, Unstitch and Reverse Normal; the continuity-driven core (`kernel/src/bridge.rs`, G0–G3 Hermite rows) with **Blend** (`surface.blend`, #764: edge chains along one or several faces, closed rims paired seam to seam or from picked seams, a dialog), **Match** (`surface.match`), **Boundary** (`surface.boundary`, #763 — two sketch curves exact with G0–G3, three or four as the flat patch of their loop, and curve networks: Coons and Gordon surfaces through sketch, 3D-sketch or edge curves, a point for a three-sided side, G1/G2 against the faces along one direction's edges, joined into their body on request; G1/G2 on two sides that meet at a corner waits for the Gregory-type corner), **Fair** (`surface.fair`, CV fairing), **continuity analysis** (`inspect.continuity`, #770; a toolbar tool with edge markers and a legend, and curvature combs along face isocurves) and a multi-section **loft** with per-end continuity and crown, and guide rails on solid and surface lofts (one or two, scaling or stretching the sections between; #201). Also in the Class-A pass: G1…G4 blend curves in the sketch, chord and variable-radius fillets on curved edges (with honest refusals where the fit cannot hold), and a G2 corner patch where filleted edges meet (kernel; the command refuses until the patch's sections can be sewn to the blends' contacts). Left: bias/form-factor fillet sections (design recorded), a Gregory-type corner, surface Fillet between separate surface bodies (#769), Ruled (#762), Untrim (#761), curved-face Extend (#760), and every remaining #757–#772 item | deferred | — |
-| M9 | Components and assemblies: New Component / Create Components from Bodies, active component, per-component origin/bodies/sketches/timeline entries, occurrences with transforms, Copy/Paste vs Paste New, nested Browser tree with visibility and isolate; Ground, Move/Copy of occurrences, joints (rigid, revolute, slider, cylindrical, pin-slot, planar, ball) by joint origins with limits and Drive Joints, closed kinematic loops (four-bar, slider-crank: the loop's other joints follow the driven one on its branch, and driving stops where a loop can no longer close), cams (`joint.cam`: a revolute cam drives a slider or revolute follower along a closed sketch profile or the cam's edges, knife, roller or flat followers, worked out again when the profile changes; drives, studies, closed loops, contact sets), As-built Joint, Rigid Group, Contact Sets (driving and motion studies stop where bodies in a set would pass through each other), Motion Study (joint values keyed along a timeline, playback, export of occurrence positions as JSON/CSV), motion analysis (joint values and a point's path charted over a study as value, velocity and acceleration; the parts that collide along a study, with the steps where they do), Exploded views (automatic or by hand, shown without changing placements, and exported as an animation coming apart and back together); interference, per-component physical properties; STEP with assembly structure; URDF export for robot simulators (links with meshes, mass and inertia; joint chains whose values match Drive Joints; docs/urdf.md). Physical properties now measure material-aware component/occurrence placements, descendants and repeated instances, including pending moves and body reassignment offsets; contact geometry and automatic exploded centres respect those offsets. Groundwork done: component tree, occurrences with transforms (instances, Paste New), world placement, active component as authoring frame, ground, Capture/Revert Position, moving bodies and sketches. UI: ASSEMBLE panel dialogs for New Component, Joint (snaps on faces, edges, circles and vertices; animated motion preview; offsets, flip, limits), As-built Joint, Joint Origin, Rigid Group, Drive Joints (live slider), Motion Link, Cam and Interference (overlaps shown red); joints in the timeline and the Browser | in progress | 32 |
-| M10 | Sheet metal: flange (base, edge, contour), hem, unfold/refold, convert, flat pattern + DXF, rules: done. PLASTIC enclosure subset: Boss, Rib, Web, Lip/Groove, Snap Fit, Rest, Plastic Rules (library, edit, assign; rule draft and clearance as feature defaults): done, tested against hand-computed geometry. UI: SHEET METAL and PLASTIC tabs with dialogs (live preview, Edit Feature, pre-selection) for Flange, Hem, Unfold/Refold, Convert, Sheet Metal Rules, Create Flat Pattern (flat view with bend lines, bend table CSV/JSON and DXF export with exact circle/arc/line cutouts), Boss, Lip/Groove, Snap Fit, Rest, Manage and Assign Plastic Rules; Fold (bend along a sketch line); flanges meeting at a corner closed at any angle with the rule's gap; edge flanges with their own angle and height per edge in one feature; corner reliefs (notch, round, rectangular, tear) chosen by the rule; Convert to Sheet Metal from a solid or shelled body by its bend edges (flat faces, sharp bends) | in progress | 36 |
-| M11 | 2D drawings | deferred | — |
-| M12 | Release: cross-platform packages, verification and deliberate publication implemented; original current-UI demo refreshed. macOS Developer ID signing and notarization are in the release workflow (#5749; they switch on when the Apple secrets exist). Windows installer signing and broader performance work remain | in progress | 16 |
-| M14 | Configurations: a table of rows (parameter expressions and feature suppressions per row) switched with config.activate (undoable, all or nothing), kept through parameter renames and feature deletes (config.configure, config.table, config.column/row/activate). Per-row body materials and appearances (library looks, custom colour/opacity and clearing overrides), undoable activation and save/reopen: done. Ordered typed configuration rules, atomic validation and structured rule editing: done. Component appearance and certified semantic face style columns, atomic preview/apply and independent-copy remapping: done. Exact constructed sketch-side and immutable imported-face lineage now preserve legacy names and reject retargeting. Left: ambiguous shifted/two-sided caps | in progress | 4 |
-| M13 | Never lose work: atomic saves (temporary file, flush, rename; a crash at any moment leaves the old file or the new one) with the replaced version kept as `<file>.bak`; autosave of unsaved changes to the recovery folder every 5 minutes (preference) and after big operations, only when something changed; "Recover unsaved design?" on the next launch (`doc.recovery_list`, `doc.recover`, `doc.recovery_discard`); a kill-mid-save test (process killed while saving a 0.5 MB design 25 times). File format: `"format": "solidcraft/12"`, older formats upgraded step by step (`doc::format`), newer ones refused with a message, out-of-range numbers and broken placements refused; a corpus of designs saved by M0, components-era, joints-era and current builds (apps/solidcraft-cli/tests/corpus) that must open and evaluate as saved; damaged and hostile variants (truncation, bit flips, hostile values, removed keys, repeated features, deep nesting) never panic | done | 6 |
-| M15 | Frames and weldments (#4003): structural members along 2D and 3D sketch lines, butt and mitre corners, trim to faces and bodies, end caps, gussets, cosmetic welds and a cut list. Done: the profile library (`frame.profile.list`, `frame.profile.properties`, `frame.profile.insert`): bar, round bar, rectangular and round tube, angle, channel and I-beam, each SolidCraft's own parametric definition with exact fillet arcs and exact section properties (area, centroid, second moments), tested against hand-computed values; members (`frame.member`): one body per straight line of a 2D or 3D frame sketch, following parameter edits, with a built-in profile (its dimensions parameter expressions) or a profile sketch (its drawn material by alternating nested loops), anchor, angle and mirror; each member's name kept with its line. Left: corners, trims, end caps, gussets, welds, cut list, FRAME tab and dialogs | in progress | 60 |
-
-M6 navigation preferences include **Touchpad**: Shift + pointer movement pans, Alt/Option +
-pointer movement orbits without a mouse button, and vertical scrolling zooms. Other presets
-retain their saved two-finger scroll preference; camera motion is available through
-`view.navigate` and modifier-aware `ui.move` automation.
-With the **Fusion** preset and two-finger pan enabled, two fingers pan and Shift + two fingers
-orbit freely, with pinch zoom and mouse bindings unchanged. The shared navigation handler
-applies the same gestures to model and Render views and blocks orbit on flat pages.
-
-UI redesign (#2016): the File/start view (#2027) uses shared light/dark navigation,
-action tiles, recent rows and sample cards, with recovery review and Save As/Export
-entry points. Document loading, sample caches and recovery safety retain their
-existing command paths.
-
-M11 precursor: File → Export Current View as DXF exports shown placed bodies and sketches from the current
-camera as a 2D millimetre drawing, with hidden edges omitted or dashed. Vector occlusion splits
-partly hidden edges and includes curved silhouettes. Repeated part meshes and triangle
-hierarchies are shared; bounded desktop preparation and occlusion use up to eight workers.
-Curves are approximated; drawing sheets,
-annotations and exact projected curves remain deferred. See [view DXF](docs/view-dxf.md).
-
-Drawing foundations: [RFC #860](https://github.com/tangency-labs/solidcraft/issues/860)
-and the [foundation ledger](docs/drawing-foundations.md) track the bounded implementation
-packages. The first geometry increment defines validated section records in a plane-local
-frame; the ledger separates that contract from section producers and the Drawing workspace.
-
-Desktop view DXF export runs in the file-operation worker with five-stage progress and
-cooperative cancellation. Curve tolerance (0.0001–1 mm, default 0.01 mm) is remembered alongside
-the hidden-edge setting. Cancelled exports preserve the model and the previous destination;
-completed drawings publish atomically. The browser still exports synchronously.
-
-## Interactive modelling
-
- Modelled threads preview their cut before OK using the background worker on desktop.
-  Browser users apply the cut with OK to avoid blocking on every edit.
-
- Thread resolves a suggested metric size when a cylindrical face is picked. Diameter and
-  pitch selectors expose the existing metric designation parameter; custom designations stay
-  editable, and Automatic size returns to the face's suggestion. Cosmetic/modelled and
-  full/partial-length options remain available. This does not add tolerance classes or
-  left-hand threads.
- New Body extrusion and face-offset previews show completed intermediate geometry while a
-  drag continues, then catch up to the exact final value. Changes to the selected geometry,
-  operation or feature still discard obsolete results. Distance arrows and their value boxes
-  follow the current frame's input.
- Large fine modelled threads use pitch-based helix resolution and tighter faceted
-  reconstruction fallbacks, preserving thin crests and closed shells on large shafts.
-
-## Physical material data
-
- Physical material card validation (#923/#922) provides typed SI mechanical and
-  thermal data, per-property sources/conditions and isotropic/orthotropic stability
-  checks through read-only `material.properties.validate`. It does not assign or
-  persist properties, provide a solver or enable rendering; see
-  [the contract and staged follow-ups](docs/physical-material-cards.md).
-
- Directional elasticity (#994) queries the validated card in material-local axes
-  through read-only `material.properties.directional`, with source/condition review.
-  It does not assign body frames, predict structural behavior or enable a solver.
-
-## Library foundations (#785, #786, #787)
-
- Local scalar libraries (#846) inspect/export bounded portable catalogs and copy exact
-  selected appearance/material revisions into existing design definitions in one undo step.
-  Appearance offers local loading/search/export; physical materials use existing commands.
-  This slice is independent of the render stack and does not change the document format.
-  See [the contract and limits](docs/book/src/dev/local-libraries.md).
-
- Proposed phases cover offline bundled/project/user packs, physical materials and
-  appearances, editable wood mapping, and parameterized component/assembly families.
-  Stable identity/revision, copied design definitions, provenance and resource limits
-  apply from the first implementation. Existing material, appearance and standard-part
-  commands remain the application paths. See [the proposal](docs/book/src/dev/libraries.md)
-  for source/license review and acceptance gates. This is planning only: pack loading,
-  texture rendering and expanded component families are not implemented by this entry.
-
-## Render foundation
-
- Original starter appearances (#1722): 34 opaque recipes through existing commands, with six explicitly unavailable glass recipes and preserved legacy looks; see [the contract](docs/render-starter-appearances.md).
-
- Bounded linear film accumulation (#1696) supplies caller-admitted mean/variance storage and complete-pass views; actual progressive consumers remain separate. See [the film contract](docs/render-film.md).
-
- Definition-local visual mapping (#1214) supplies a bounded numerical frame, physical repeat coordinates and a deterministic one-time grain-axis suggestion. It adds no saved record or texture consumer; see [the mapping contract](docs/render-visual-mapping.md).
-
- Explicit texture normalization (#1218) produces completed float RGBA with
-  role-aware linear color/data semantics, bounded matrix/TRC ICC conversion and
-  opt-in EXIF orientation. It retains high-precision raw samples and records lossy
-  gamut clipping only when explicitly requested. It is not a renderer/resource
-  consumer; see [the supported policy and limits](docs/render-texture-normalization.md).
-
- Opt-in opaque PBR (#1046) connects persisted surface parameters to the integrated
-  product viewport and CPU PNG, using a fixed direct-light studio. Geometry and mass
-  stay unchanged. HDRI, transmission and textures remain separate gates.
-  See [the consumer and limitations](docs/render-opaque-pbr.md).
-
- Combined integration is tracked in #842, with independent scalar libraries in
-  #863 and richer PBR/material-card transport in #1086. See [phase boundaries and validation gates](docs/render-integration.md).
-  Render/library consumers use the merged asynchronous picker (#1127). Material-card
-  UI (#1094), texture mapping and HDRI lighting remain explicit follow-ups.
-
- R4a adds bounded CPU product-image jobs, cancellation and atomic PNG export through
-  engine commands, the Render panel, CLI and persistent MCP. Immutable captures and
-  results stay outside persistence/undo; native workers and cooperative browser tasks
-  share the same work protocol. See [jobs, limits and export](docs/render-jobs.md).
-
- R3 adds an overlay-free product scene and the integrated Render workspace, with
-  runtime GPU host capabilities, per-document drafts and named camera/background
-  controls. Design keeps its camera and drawing policy. Raster transparency remains
-  approximate; PBR and environments are later slices. See
-  [workspace and scene contracts](docs/render-workspace.md).
-
- R2 adds bounded named render setups in document format 21 and the read/save
-  `render.settings.get/set` commands. Proven render-only changes preserve geometry
-  and prepared world data through undo/redo and checkpoint restore. This slice does
-  not add a Render workspace, PBR, environments or image jobs; see
-  [settings and refresh policy](docs/render-settings.md).
- Bounded PNG/JPEG texture admission (#900) validates in-memory sources and returns
-  completed RGBA8 pixels with explicit color/data roles. It is an input utility only:
-  ICC/16-bit normalization, local wood mapping, resource persistence and the renderer
-  consumer remain separate work. See [limits and licensed-file probes](docs/render-texture-input.md).
-
- The initial opaque surface numerical contract for #1004 provides bounded linear
-  color/metallic/roughness/IOR admission and an original tested direct-light BRDF.
-  The numerical module alone advertises no capabilities; the installed consumer above
-  provides rendering. See
-  [the model, evidence and remaining consumer gates](docs/render-surface.md).
-
- A bounded cooperative Radiance RGBE input utility is available in L1 render;
-  it does not yet enable HDRI/PBR rendering or a document import command. See
-  [the input contract](docs/render-hdr-input.md) and #813 for integration work.
- R1 adds renderer-independent backend/profile metadata, strict request resolution and
-  bounded image/scratch admission checks, exposed by the read-only `render.backends`
-  command. It describes the current CPU raster snapshot path without evaluating the model.
-  The legacy Design snapshot route remains unchanged. Later slices above provide the
-  workspace/jobs and opaque PBR; HDRI and optional engines remain future work. See [the contract](docs/render-backends.md)
-  and [the phased proposal (#620)](https://github.com/bherbruck/solidcraft/issues/620).
-
-## Dimensioning and error reporting
-
- Operation length fields share design-unit defaults and input evaluation, including secondary
-  distances, thin walls, blend controls, sheet/plastic rules, joints and motion keys. Canvas
-  handles and sketch previews use the same lengths as committed geometry. Existing stored
-  millimetre values retain their size when edited in a design using another unit (#3271).
-
- MCP `execute` accepts `verbose: false`, sharing the compact reply helper used by
-  `batch`: body changes and created sketch IDs stay, while repeated lists are omitted.
-  Both tools retain full replies by default.
-
- Sketch Create groups drawing variants under Line, Rectangle, Circle, Arc, Slot,
-  Polygon and Spline. Each open part remembers its last interactive choice per family
-  across sketch sessions and document-tab switches; closing the part resets these UI choices.
- Inscribed, circumscribed and edge polygon tools preview their actual outline before
-  placement, including orientation and the selected side count.
- Construction (X) preserves the active sketch drawing tool, picked anchors and inline
-  dimension values, so line type can change while a shape is in progress.
- Planar sketch construction previews and hover feedback keep the same dashed pattern as
-  committed geometry; centerlines retain their dash-dot pattern.
-
- Point has a default Sketch CREATE toolbar button alongside the existing drawing tools.
-  Saved custom layouts are preserved; Reset Toolbar restores the default Point button.
- Construction planes cannot take an origin-plane name (XY, XZ, YZ, Top, Front, Right). Plane
-  arguments reject such a name when an older design's construction plane already has it. Use
-  the other alias, the construction feature's numeric ID or an explicit plane; existing
-  stored references keep their saved meaning. Section Analysis uses the same check.
- Sketch text can be edited from a letter interior or outline's context menu or the Edit Text command.
-  Interior selection requires every profile boundary to belong to the same text source;
-  the editor highlights the whole source without replacing profile selections.
-  Content, baseline X/Y, height and rotation update the original text source in one undo step;
-  cancelling or rejecting an invalid value preserves the sketch. Position and height fields
-  use the document units captured when editing starts; generated outlines remain associated
-  with their text source, and untouched inputs preserve their saved internal values.
-  Dragging a text outline moves the entire source in one undo step; Escape restores the
-  gesture. Move/Copy on a selected text outline provides unit-aware X/Y distances and rotation
-  about its baseline; copies keep an independent editable text source.
- Repeating the initial point of a planar multi-point sketch drawing tool is neutral: the tool
-  waits for a distinct point without a degenerate-shape error or history entry. Typed input
-  and programmatic commands retain their validation.
- Circular-pattern and angled-plane axes reject explicitly supplied malformed or expression
-  origins instead of silently rotating about zero. Numeric origins remain in millimetres;
-  associative axis expressions and construction-axis references remain unsupported.
- Single-line and rectangle-side dimensioning supports selecting a line or its two endpoints.
-  Type a value and press Enter to commit one undo step; rejected values remain editable and
-  cancellation leaves the sketch unchanged. Fit keeps geometry clear of the Sketch Palette
-  and navigation controls, including enlarged displays and nested pending placements.
- Sketch Dimension takes a line and a circle or arc (#1803): it measures from the line to the
-  circle's edge (the gap, 0 when tangent, or how far the edge reaches past a line that cuts
-  it), drives it like any other dimension and keeps the circle on its side of the line.
- Sketch Dimension takes a point and a circle or arc, or two circles or arcs (#4064): it
-  measures to the circle's edge (from the point, or between the two edges: the gap, 0 when
-  they touch, how far they overlap, or the narrowest gap between nested circles).
- Sketch annotations, live drawing lengths and Measure use document units. Inches show
-  three decimals and retain a meaningful fourth digit. Bare length dimension entry captures
-  the current design unit; changing units leaves existing geometry and expressions intact.
-  Component/canvas distance controls, sketch cursor coordinates, flat-pattern dimensions
-  and pocket depths, interference volumes and parts-library lengths also use design units.
- Curvature and Polygon constraints accept complete preselected operands. Fix/Unfix
-  consumes complete point/curve selections consistently; mixed or ambiguous selections
-  retain the picking workflow. Rejected constraints preserve selection and undo history.
- Contextual error reporting: a **Create Issue** action beside feature errors opens a
-  reviewable GitHub issue draft with the error, operation settings, build diagnostics and
-  useful reproduction context. The draft is editable, with optional capture of the actual
-  viewport and copy/save controls. Opening GitHub does not submit the issue. Help also exposes
-  reporting for unexpected results that did not produce an error.
- The header exposes **Report a bug**, including an accessible compact control on
-  narrow windows. It opens the same editable report and screenshot review without
-  changing the active model or a pending dimension.
- Crash reports: every panic (in a command, in the kernel, anywhere else) and every unclean
-  exit (abort, stack overflow, kill: found at the next start through a locked per-run command
-  journal) leaves a local report with the backtrace, version and commit, the command and the
-  design that reproduce it (`solidcraft-cli crashes replay <id>`). Repeats are counted, not
-  rewritten; at most 20 reports, 50 MB and 90 days. The app shows them after a crash (Help >
-  Crash Reports…) with a reviewed issue draft; agents read them through
-  `diagnostics.crash_reports`, the MCP `crash_reports` tool or the CLI. Nothing is sent
-  anywhere. See [crash reports](docs/crash-reports.md).
- Agent chat (off by default, desktop): a side panel that drives a coding agent the user
-  already has (Claude Code through its ACP adapter, Codex, Gemini CLI, OpenCode, Grok Build, …) over the
-  Agent Client Protocol, under the user's own login; SolidCraft stores no keys. The agent works
-  through SolidCraft's MCP tools on a gated endpoint of its own: file actions wait for Allow or
-  Deny, crash reports are off limits, 24 changes per message, one undo step per message, and
-  the agent's whole process group ends with the panel or the app. Docks left or right,
-  minimises to a strip. Grok Build discovery includes `~/.grok/bin` and reuses the user's
-  Grok login. See [agent chat](docs/agent-chat.md).
- Command scripts from designs (#886): `timeline.export_script` (CLI `solidcraft-cli script`)
-  writes a design's history as a script that `eval` and `run` replay into the same design —
-  user parameters, units, sheet metal and plastic rules and materials as their own commands,
-  then each feature through `timeline.add` with its ids, names and dimension parameters kept,
-  so every feature kind replays exactly and a failing feature fails the same way. Trimming the
-  script after a step gives the design at that step. Appearances, folders, views and
-  configurations are listed as left out; components and joints are not supported yet.
-
-## 0.2.0 release batch
-
- Includes the new axis navigation, adaptive sketch drawing/picking, origin-corner repairs,
-  durable supported profile/face references, endpoint dimensioning and contextual reporting.
- Smooth ruled-wall display joins are hidden only within the supported geometric certificate;
-  authored splits and actual creases remain protected. Wireframe retains physical edges.
- Paste New uses a bounded current-geometry comparison for supported convex line/circle
-  prisms with separated circular holes; unsupported shapes retain the existing strict check.
- Common-bore Union retries check additional boundary curves before recutting the bore,
-  preventing the reproduced thin-web loss. Unknown additional trims refuse; inherited
-  common-cylinder trims retain their existing policy, so this is not a general Boolean proof.
- Exact full-path assembly joint editing remains separate work and is not part of this batch.
- Stable 0.2.0 is published: all release payload checksums, native cold reopening, deployed
-  web app and both Flatpak architectures were verified. The replacement README demo uses
-  the original electronics enclosure story and animated pointer in the actual English
-  0.2.0 UI, at 4× playback. Publication follows [the release workflow](docs/releasing.md).
-
-## 0.2.1 critical fixes
-
- Separated multi-profile Join/Cut extrusions into one solid target batch their tools using
-  conservative construction bounds, avoiding a Boolean rebuild for every profile. Live
-  extrusion previews build only their tools; confirmation validates the final Boolean.
- Coplanar selected body faces share one linked sketch and one extrusion. Automatic Join/Cut
-  keeps the evaluator's participant scope, including parts of an empty imported component. Desktop OK/Enter
-  computes on a scratch session in the background, with atomic acceptance and cancellation.
-  Planar section stitching projects lines/arcs analytically and removes duplicate endpoints.
- Imported rotated face groups can check all full start-face seams in one guarded
-  construction. Separated tools may batch a Join when each meets the same single body;
-  nearby uninvolved bodies retain the original contact decisions. Regression comparisons
-  cover all four extrusion operations.
- Inward multi-face cuts retain every eligible target and subtract separated tools together.
-  Safe interior classification handles roundoff at shared imported line/arc endpoints.
-  Straight extrusion feedback caches existing face/profile triangles and updates the display
-  directly, including a newly opened STEP's single identity component placement; other
-  extents, moved or repeated components and curved sketch profiles keep the Engine preview.
- The extrusion fixes retain tracked Boolean history and the current `solidcraft` packages.
-  Confirmation and tool previews use main's shared background calculation. Main's collapsed
-  blend-wall refusal and its tests are retained, including smaller valid radii and mirrored parts.
- Axis view and navigation controls stay anchored to the viewport when feature dialogs or
-  the command palette open, at normal and enlarged display scales. Fit still accounts for
-  dialog coverage; covered controls do not receive clicks through dialogs.
- Eligible planar faces survive fillet, chamfer and shell operations with exact source
-  certificates. Sketches placed directly on the enclosure wall and inner floor follow
-  width and wall changes, including after the USB cut and cold reopening.
- Remove artificial straight-wall and rounded-corner subdivisions left by shell and
-  extrusion cuts. Identical generated wall segments span adjacent slabs as one physical
-  face, with exact full-height supports and boundary stitching. Preserve authored face
-  splits and face appearances. Permanent regressions cover material, STEP, reopening and
-  unaffected bodies across the extrusion end plane.
- Feature dialogs use the available screen height for their fields, with OK and Cancel
-  outside the scrolling region, including enlarged display scales.
- Design format 13 records shell-face attachments. Older designs remain readable;
-  newly saved designs require 0.2.1 or later. Ambiguous or unsupported faces still refuse
-  attachment rather than guessing a plane.
- Saved projections from a removed strip retain their geometry and report the lost
-  reference. Explicitly reselect the wall to repair that projection.
-
-## Workspace layouts (#2029)
-
- General preferences save Floating or Compact using the universal UI containers.
-  Compact joins the workspace selector and ribbon, docks the content-hugging Browser
-  flush beneath them with a square join, and opens tool sheets below the compass.
-  Sheets remain draggable, rounding all corners away from their right dock; footer
-  backgrounds follow the same corners. A separate preference hides ribbon icon labels
-  for a shorter ribbon in either layout.
-  Assistant keeps the outermost edge and History keeps its chosen dock. Switching
-  retains the active tool, camera, selection and design; system windows and menus
-  keep their existing behavior.
-
-## View navigation
-
- Navigation has an opt-in Free orbit preference for mouse and 3D-mouse rotation through
-  both poles with roll. It defaults off, preserving existing preset snapping and pole limits.
-  The SolidWorks face menu offers Normal to Selection (`view.normal_to`), shared with Look At
-  and Ctrl+8, including repeat-to-flip, preserving scale and projection.
-
- Desktop Ctrl/Cmd +/- and 0 change or reset the saved UI scale. The scale slider keeps
-  its layout stable during a drag and applies the selected scale on release.
-
- OpenSCAD navigation preset: left drag orbits, right/middle drag pans, Shift+right/middle
-  drag zooms, and the wheel zooms. Available in the shared desktop/web Navigation preferences.
- Compact clickable signed X/Y/Z axis tips, smooth drag-to-orbit, and Shift-orbit snapping
-  to 26 standard and diagonal views. Pointer motion accumulates independently of a lightly
-  damped spring, with a boundary margin to prevent flicker. Z-up/Y-up and the nearest square
-  top/bottom heading are preserved. Diagonals include 45-degree edge and isometric corner views.
-
-## Known limitations
-
- Scheduled and manual CI scan locked dependency advisories, bans and sources with
-  cargo-deny. Vulnerabilities fail the scan; unmaintained crates warn. Local vendored
-  patches require separate upstream review because advisory databases cannot version-match
-  their path dependencies. Pull requests retain the existing licence checks.
-
- Associative shell-face sketches require a unique certified planar source. Nested shell
-  attachments and ambiguous coincident sources remain unsupported.
- G2 fillets: exact quintic blends of straight edges between planar faces, with one planar
-  end face at each end, including sloped ends (#2708). The UI and `solid.fillet` expose
-  `curvature` (alias `g2`); the size is an equivalent circular setback. Curved faces/edges,
-  multi-face ends and corner junctions remain unsupported.
- Fillets and chamfers: constant, variable-radius and chord-length fillets; a radius per edge,
-  rounds next to earlier rounds of another radius, and smooth corner patches where three rounds
-  meet (a sphere for equal radii); perpendicular corner fillets after a closed ring of earlier
-  rounds preserve the ring's radii and the enclosed planar face (#1557);
-  mitres between separate rounds of the same radius keep their endpoint tangent, so a later
-  fillet can select an upright and its adjoining bottom mitre as one chain (#2422);
-  straight edges (convex or concave) between planar faces with perpendicular
-  planar end faces (equal-distance chamfers also meet sloped planar end faces, including inner
-  basin rims within the rim width); convex fillets also meet sloped planar ends and reflex
-  corners around pocket rims, with unequal wall slopes and extensions confined to the face;
-  connected equal-distance chamfers also trim each other across unequal sloped rim walls;
-  curved chamfer chains with straight planar ends can terminate across two existing planar
-  bevel faces, splitting their shared seam; picks on the same tangent chain are applied once (#1303);
-  whole smooth loops of a planar face, picked whole or by one edge (tangent
-  chain), including circles and walls at any angle (boss bases and tops, bores, pocket floors,
-  plate outlines), loops with sharp corners between straight or mixed arc/line edges (straight
-  blends meet in mitres; perpendicular curved walls use offset intersections, with D-rim removal
-  checked within 0.1% of analytic offset slices), runs of
-  neighbouring edges along a planar face's loop (two top edges of a box: mitred, ending square;
-  with the edge between them too, the corner becomes a sphere octant),
-  rounded corners rounded again (sphere octants, tori at concave corners); every edge of a
-  convex planar body or of an extruded part; fillets inside patterns; closed chains of curved
-  edges between any two smooth sides (a branch pipe on a main pipe), by a rolling ball (the
-  blend a rational B-spline through exact arcs), closed or ending at planar faces square to the
-  edges, where straight or curved cap edges are trimmed to the contacts (the straight edge
-  between two overlapping extruded arcs); knife edges, where the two faces have opposite
-  normals (a wall that runs out tangent into a face: the ball that fits there); an edge that
-  runs out along an end face tangent to one side (the arc top edge of that wall), cut where the
-  blend meets it; rounds that end in an earlier round on curved faces, in any order (the rounds
-  of two edges at a vertex meet in a crease, as on a box), picked together or one after the
-  other, except a round after a round of the edge between the wall and a flat face that it
-  would run over; the three edges at a vertex of any smooth faces, of one radius, end in a
-  piece of sphere. A limiting blend that collapses a side wall into coincident boundary
-  curves is refused as too large rather than returning an unmeshable face (#1113).
- Booleans: prisms along one direction (plates with holes, slots, patterns of them, equal
-  sections stacked end to end) are combined exactly in 2D. Qualified axial cuts preserve
-  annular holes with overrun cutters, including inward Press Pull after a joined extrusion;
-  curved wall qualification rejects false transverse axes instead of filling holes.
-  Bodies touching along one whole face
-  (a part and its mirror image) are stitched; coincident planar faces are pushed apart when
-  their neighbours are planes or cylinders. Other coincident curved configurations can still
-  fail. Bounded containment classification preserves fully internal cavities and nested
-  material islands independently of shell order, with STEP round-trip and material-membership
-  regressions. Near-contact curved shells use the general boolean path rather than a
-  containment shortcut. Spheres are built from six pole-free patches.
- Mass properties come from fine tessellation (curved faces within ~1e-4 relative); triangles
-  that cut through curved faces (trimmed faces after booleans) are split onto the surface first.
- STEP import (our own reader, crates/kernel/src/step_in) reads solids (B-rep with analytic and B-spline geometry), units,
-  product names, colours and assemblies; analytic offsets on planes, cylinders, cones, spheres
-  and regular tori are read exactly (signed/nested distances, units and face sense). Freeform
-  offset surfaces and pcurve-only edges are not read yet,
-  and assembly components are flattened into bodies. Closed periodic faces (torus, B-spline
-  bands) are split in two for meshing; measure() uses a finer tolerance for small radii.
- Persistent naming follows the kernel's exact face history (docs/book/src/dev/naming.md):
-  references resolve by name first, follow splits and merges, and warn when the entity split,
-  merged or vanished, or was found by geometry only (operations that report no history yet).
-  New planar sketch attachments use exact box, extrusion cap/side and immutable imported-face
-  source certificates with checked target and author occurrence paths. A missing or changed
-  source fails explicitly; Redefine Sketch Plane previews reattachment or a fixed plane while
-  retaining current geometry and dimension identities. Unsupported modified faces need an
-  explicit fixed plane. Legacy attachments retain their original resolver behavior.
- Modelled threads are cut as a faceted body (curved faces within 1/200 of the pitch); Extrude
-  and Revolve To Object on a curved face cut the tool back to the target's surface.
- Explicit sketch breaks preserve exact ellipses, fit/control splines (including high degrees)
-  and conics; analytic trim/break also sees free-form cutters. Free-form curves cut at a tangent
-  touch (no clean crossing) enter that profile as polylines.
-  Sweeps along 3D sketch curves follow their polyline (smooth walls when the path is smooth).
-  A sweep with a twist, an end scale or a parallel or direction orientation (#771) follows its
-  path that way too, even along sketch lines and arcs: B-spline walls through stations, ruled
-  walls through denser stations where the path has corners or the profile has holes.
-  Guide rails (one or two, #771) do the same: each station meets every rail once, and the rail
-  turns the profile and scales it (or stretches it across to the rail) against the start; two
-  rails carry it between them. Rails along a path with sharp corners are refused for now.
- Extend intersects exact ellipses and rational/high-degree splines without moving the line or
-  circular support. Associative free-form offsets have a whole-span 0.002 mm normal-distance
-  certificate and refine within bounded node limits while retaining existing IDs.
-  At the node limit, geometric certificate subdivisions accommodate unequal spline parameter
-  speeds without changing stored nodes or relaxing the distance tolerance (#971).
-  Associated offset fit nodes stay hidden from display, picking and snapping; dragging the
-  editable source updates the derived boundary live. Break Association restores point editing.
-  Singular, self-intersecting and ambiguous curves refuse atomically; mixed junctions and nonsmooth
-  closed natural-spline seams remain limitations. New explicitly closed fit splines and closed
-  offset outputs use periodic C2 interpolation, supporting repeated certified offsets; older
-  natural splines are preserved. Clicking the starting fit point deliberately closes a new loop.
-  Newly captured adaptive profile references with complete source coverage retain their outer
-  and hole identities through span-count changes, including parameter edits after extrusion.
-  Partial, intersected or ambiguous boundaries do not qualify for these whole-source references.
-  Legacy curve-span multisets remain exact and unchanged; already-lost selections may need
-  reselection. Format 12 stores the new bounded whole-boundary references.
-  Projected analytic boundaries follow nested loop identities through resizing, including
-  stationary holes and rounded corners. Supported convex, tangent line-and-arc boundaries
-  can lose or regain corner arcs during an inset while preserving reserved curve identities
-  and linked profile selections. Format 12 saves those associations; compatible older closed
-  offsets upgrade structurally without changing their curve IDs. Breaking an association
-  freezes its current boundary and materializes downstream profile references. Child offsets
-  of a boundary with retired arcs still require breaking its association first; mixed or
-  nonconvex junctions and retained references to disappearing individual arcs remain limited.
- Extrude and Revolve editors retain original direction, extent expressions, explicit targets,
-  axes, From/To inputs and All-profile intent. No-op edits preserve downstream dimension names
-  and selected occurrence frames; cancel and successful edits preserve one-step undo history.
-  Placed feature edits preview through the edited timeline entry, and cylindrical Emboss guides
-  use the sketch's actual target, author or uniquely placed third-component frame.
-  Revolve rotators follow the actual signed axis and support symmetric and two-sided extents;
-  dragging a To Object extent converts its derived value to an explicit angle. Legacy reversed-axis
-  symmetric geometry is preserved through format 11's explicit legacy convention. New revolves
-  use the sketch-normal direction for each selected profile, including To Object and curved
-  target trimming, independently of the selected axis sign.
- Cylindrical emboss/deboss wraps bounded orthogonal line profiles, including holes, concave
-  outlines and nested islands, onto complete exterior cylinders or coaxial sleeves with exact
-  radial walls. New features infer a unique eligible cylinder when the face field is empty;
-  ambiguous targets require an explicit face. Saved target
-  and author occurrence paths retain the chosen placements; missing/split faces refuse rather
-  than retarget. General free-form profiles, seams, stepped cylinders and other curved surfaces
-  remain unsupported. STEP round-trip and independent radial/volume checks cover this subset.
- Shell and offset faces work on bodies of planes, cylinders, cones, spheres and tori (convex or not:
-  filleted boxes, bosses, domes, countersinks; corners where four or more planes meet, such as a
-  floor falling to a drain, as long as the corner's edges are all convex or all concave); draft on convex planar bodies and on walls (planes, cylinders → cones) between caps; lofts through three or more sections are smooth (B-spline sides through every section), two
-  sections ruled. Circular-meridian barrels retain curved inner walls through either axial
-  opening (#2421). Solid lofts preserve holes through sections with matching hole counts
-  (#2435), including inner walls and caps with openings; a hole cannot appear or disappear
-  between sections, and sections with holes cannot collapse to a point.
-
- Sketch corner tools: fillet and all three chamfer modes pick a connected corner even when
-  its endpoint overlaps the fixed origin or a loose point. Ordinary drawing still snaps to
-  the origin; clicked UI regressions verify geometry, closed profiles and undo.
- Sketch display: drawing, picking, highlighting, tool previews and profile shading share
-  adaptive projected curve boundaries. Fit, zoom, display scale and placed sketch frames
-  invalidate the display cache without changing CAD geometry or timeline history. Work
-  budgets and clipped paths prevent unbounded sampling or invented edges across the eye plane.
-  The Sketch Palette scrolls its options on short windows and enlarged displays while
-  keeping constraint status and Finish Sketch visible.
- Face projection: closed boundaries have a deterministic outer-first order. Refresh matches
-  existing geometry before assigning positions, retaining saved curve IDs and constraints
-  across enumeration changes and resize, including concentric circles. Ambiguous identities
-  retain the last geometry and report a lost reference; permutation matching is bounded.
- Project accepts complete supported preselection in one undo step. Visible external sketch
-  curves and points retain their source sketch identity; model geometry, axes and planes use
-  the existing linked projection commands. Rejection preserves the document and selection;
-  mixed selections retain ordinary tool-first picking.
- Inline sketch dimensions: Tab and Shift+Tab cycle within the active shape's value boxes,
-  selecting visited values for replacement. Expression completion retains forward-Tab
-  priority; real keyboard regressions cover rectangles, lines and single-value circles.
-  Typed lengths, radii, line angles, signed arc sweeps and slot lengths persist as constraints
-  and expressions through save/reopen. Shape creation and its dimensions form one undo step;
-  rejected values keep the editable field focused.
- Repeated components: Browser selection, visibility, properties, copy and Move/Copy use
-  checked occurrence paths. Active nested occurrences author planar sketches and solids in
-  their selected frame. Pending moves compose through parents; dialog cancellation restores
-  its selected move. Source materials and body/face appearances follow transformed instances.
-  Shared nested definitions remain shared. Deep Paste New copies reachable definition graphs,
-  independent feature/input histories, styles and internal motion records, with bounded geometry
-  checks and explicit external-link notices. Paste New selects the copy while preserving the active
-  authoring context. Imported periodic STEP seams survive placement and reexport with shared
-  topology and appearances intact. Recorded body transfers preserve historical Join/Cut membership,
-  material, placements and machining data through edits, copying, undo and reopen. New 3D wires
-  record their coordinate frame; legacy wires migrate from known provenance without changing
-  coordinates. Broken legacy links with missing provenance can require explicit refresh or relink.
-  See [occurrence workflows](docs/occurrence-workflows.md).
- Toolbar drops on panel labels, gaps and margins append commands with insertion feedback;
-  button drops keep insert-before ordering.
- Parameters and Configurations have distinct actions in the SOLID toolbar's CONFIGURE panel.
-  Parameters opens the user/model variable editor; Configurations opens the configuration table.
-  Configure remains available in the panel dropdown.
- Parameter creation supports Enter with validation and continued keyboard entry. Shared
-  expression autocomplete supports Up/Down selection, Enter/Tab acceptance and Escape dismissal;
-  accepting a suggestion does not submit a parameter or trigger viewport shortcuts.
- Movable window title bars follow the app's dark/light header palette. Radial right-click
-  menus are opt-in in Preferences > Navigation; ordinary context menus remain the default.
- Desktop distribution: running Windows windows and executable resources use the app icon;
-  packaging validates icon resources. Nix installs launchers, MIME data and generated icons,
-  with explicit launch apps and Vulkan-loader/driver discovery. Flatpak feed instructions
-  register the required runtime source; release checks exercise desktop modelling on X11/Wayland.
- OpenGL rendering clamps effective anti-aliasing to 1x across UI pipelines, textures and CAD
-  callbacks to prevent black frames. Other backends retain the requested sample count, and
-  stored preferences remain unchanged.
- Configuration rules: ordered typed conditions can drive parameters and suppressions or
-  restrict values. Preview explains effective values without modifying the document; applying
-  rules validates rows atomically. Length expressions retain their authoring units across
-  document-unit changes. The UI supports structured All/Any/Not conditions and rule ordering.
-  Component styles and certified semantic face styles are available; unsupported lineage refuses
-  atomically, and stale certified face paint cannot jump to another surface. See [configurations](docs/configurations.md).
- Sheet-metal material: inherited holes, crossing edge notches, overlapping cuts and retained
-  islands share the same boundaries in flat preview, DXF and unfolded solids. Detached material
-  pieces survive unfold/refold as one logical sheet group, including split flanged sheets.
-  Cut-outs made in the flat pattern cross bends at any angle or curved: their edges fold to
-  helices and curves on the bend, their walls square to the sheet. Free-form bases use bounded
-  sampling.
-  Parallel prismatic partial-depth cuts retain pocket side and depth through transfer and
-  unfold/refold, with separate pocket contours in preview and DXF. Planar Intersect preserves
-  exact holes and retained islands, including the union of multiple selected profiles, and
-  records complementary depth layers as pockets while retaining the stock gauge. Unsupported
-  tapered or bend-crossing machining refuses atomically instead of restoring material later.
-  Sketches attach to a sheet's flat faces (base and flanges, either side) by panel, in the
-  flat pattern's coordinates, and follow it through rebuilds and unfold/refold.
-  A flange on another flange's far edge (a return) follows that flange's closed end and keeps
-  clear of the flange beside it, and the returns of one feature are mitred toward each other
-  with the rule's gap where their flanges meet at a corner; returns of separate features, and
-  flanges on returns, are not closed toward each other.
- Rolling-ball fillet accuracy: independent offset-cylinder tee references check surface
-  distance, actual trimmed tessellation, supporting-cylinder contacts and tangency at two
-  scales. The measured trimmed-part error is below 0.0001 mm; this is an analytic geometry
-  check. Under-resolved fits return an error.
- Contact driving checks the trajectory between clear endpoints, including linked joints,
-  playback and sparse motion exports. Checks use bounded tessellation samples, not exact
-  continuous collision detection; local thin walls and small details remain limitations.
-  See [contact-set limits and recovery](docs/contact-sets.md).
-
-## Assembly dragging
-
-The design's first part is grounded when it is made, and a left-button drag repositions a free part (`occurrence.drag`: one undo step, exact occurrence paths including repeated jointed definitions, any floating-chain member carries the chain, grounded parts and joints hold where present, Escape cancels).
-
-## 3D sketch bridges
-
-3D sketch drawing snaps to points on other visible sketch planes without flattening them onto
-the active plane. Bridge endpoints capture their source positions; associative endpoint links,
-construction-plane selection of 3D wires and loft guide rails remain separate work.
-Feature dialog header chevrons collapse and restore the form without discarding selections
-or edited values, including the Appearance panel.
-## Construction on 3D paths
-
-Plane Along Path has a viewport path selector, fractional position, live preview and timeline
-editing. Construction planes and points resolve drawn 3D wires without applying their sketch
-plane a second time. Curved paths use sampled segments; multi-curve chains, absolute distance
-and reference-object placement remain separate work, as do loft rails and centerlines.
-
-## Design properties (#1015)
-
- Designs carry project, part number, revision, author, organization, description and licence
-  in an optional `metadata` object (File → Design Properties…, `document.metadata.*`,
-  `inspect_design`). STEP and IGES headers and 3MF model metadata take the fields their format
-  has a place for. Other tools keep their own data under a reverse-DNS key, kept as it is
-  through open, edit and save and never exported. See [design properties](docs/book/src/guide/files.md#design-properties).
-  Per-component properties (a part number per component) can follow with the same type.
-
-## Document-opening performance
-
- Desktop STEP import prepares consecutive independent solids in bounded batches with up
-  to eight workers, retaining serial traversal, result order and persistent source identities.
-  The web path remains serial. Original multi-solid fixtures show 64–81% lower complete
-  import times; single-solid assembly parts are not scheduled across nodes. See
-  [measurements and limits](docs/perf.md#parallel-step-body-preparation-2026-10-12).
- Design containers (#303, phase one) separate and deduplicate STEP, raw images and
-  lossless binary mesh arrays while keeping plain JSON as a supported Save As/export
-  format. Generated-mesh storage measurements reduce serialization and decoding work;
-  a seekable reader defers original blobs until after provisional display.
-  See [container format](docs/design-container.md) and [performance measurements](docs/perf.md).
- Warm saves with explicit `cache: true` can include a versioned native B-rep cache through SolidCraft-owned topology
-  and geometry records, with a separate truck adapter and bounded binary reader. Exact
-  face-source certificates and operation history survive codec round trips. A provisional
-  picture can be generated before original blobs are read; editing and measurement wait
-  for authoritative reconstruction. Cached metadata binds preview and reconstruction to
-  the same document despite concurrent file writes. Default saves omit this cache and never force cold
-  evaluation or meshing; explicit `preview: true` remains a separate warm-mesh option.
-  Keys, resource budgets and document/revision guards reject incompatible, hostile or
-  stale results. A second modelling kernel still requires its own tested adapter.
- Warm saves with explicit `cache: true` can also carry a bounded PNG thumbnail from already cached meshes.
-  Home reads it without rebuilding the design when its local picture is missing;
-  mismatched or malformed thumbnails fall back to normal generation. The image is
-  kernel-independent and saving never forces cold meshing to produce it.
-
- Cold rebuild profiling separates parsing, geometry, placement, display meshing and
-  thumbnails. Straight-line closest-point projection and exact curved-surface evaluation
-  reuse reduce repeated work without relaxing geometry checks. Three alternating optimized
-  benchmark runs reduce median rebuild time by 26% on the public sensor enclosure and 22%
-  on a local case assembly; shape measurements and topology match the original build.
-  See [performance measurements](docs/perf.md). Further cold Boolean and import costs remain.
- Prepared assembly geometry survives selection and view changes while real geometry and
-  placement changes invalidate it. A Pi assembly edge-selection probe drops from 9.24 s to
-  0.57 s; initial opening is unchanged. Actual Windows desktop profiling measures 15.87 s
-  median opening, with 82% spent rebuilding geometry; halving full opening remains open.
-
-## Kernel
-
- Successful Boolean retries report their strategy and numerical adjustments as
-  feature warnings and structured inspection data. Diagnostics survive cached
-  evaluation, undo/redo and cold reopening; the robustness runner counts retry
-  events by strategy and reports any bounded-log truncation. Existing geometry
-  acceptance checks remain in force.
-
- Cylinders of one radius whose axes cross (a second bore across a bore of the same size, a pipe
-  tee of equal pipes) touch at two points, where the mesh intersection cannot trace the curves
-  and a boolean cannot tell the four arms of the crossing apart. When the ordinary boolean fails
-  on such a pair, both faces are split along the line of their cylinder through the touching
-  points (the solids are unchanged), the boolean is taken of those, and its history is composed
-  back over the operands as given (#788). The result keeps the split lines as edges of the bore
-  walls. A crossing the ordinary route fails on and the split faces do not help (a radius of 17.5
-  in a 45 mm block with a tool of 80 mm) is still refused.
- Boolean intersection-curve construction refuses point-only, collapsed and non-finite
-  polylines without panicking. Direct constructor regressions retain valid open endpoints
-  and closed spherical intersections; the original interactive trigger remains unidentified.
- Shell of a stepped, joined planar body no longer creates horizontal subdivisions across
-  continuous walls. Fresh axis-aligned Cut walls are stitched using their exact construction
-  support and shared topology, preserving real steps and intentional boundaries. The local
-  reported case returns from 86 to 49 faces with unchanged material and bounds; regressions
-  cover stepped stock, STEP round trips and saved projections from removed pieces.
-
-truck (Apache-2.0) behind our own `kernel` crate, with our own blend operation and boolean
-retry/validation; see `plan/adr/0001-geometry-kernel.md` (local) — summary in README.
+The short version, for people who use SolidCraft. The detailed developer status (milestone
+tables, limitations, measurements) is in [docs/roadmap-detail.md](docs/roadmap-detail.md).
+
+## What SolidCraft is
+
+SolidCraft is open-source parametric 3D CAD written in Rust. You sketch, constrain, extrude, and
+change a parameter to watch the timeline rebuild. It runs as a desktop app and in the browser
+([try it](https://solidcraft.io/app)), and it has a command-line tool and an MCP server so that
+scripts and AI agents can drive the same commands you use.
+
+## Works today
+
+- Sketching with a constraint solver, and the usual create and modify tools.
+- Extrude, revolve, loft, sweep, coil, fillet, chamfer, shell, draft, holes, threads,
+  patterns, mirror and split.
+- Parameters with units and expressions, and configurations.
+- Faces and edges keep their names through edits, so references survive changes.
+- Components, assemblies, joints, motion studies and exploded views.
+- Sheet metal with flat patterns and DXF export, and a plastic-enclosure subset.
+- A Render workspace with GPU rendering, studio lighting, materials and image export
+  (first release in 0.22.0).
+- Import and export of STEP, IGES, 3MF, STL, OBJ and DXF, and FreeCAD and Rhino files.
+- Autosave and crash recovery, and the browser build of the same app.
+
+The full list of commands is in [docs/features.md](docs/features.md). Release notes for each
+version are on the [releases page](https://github.com/tangency-labs/solidcraft/releases).
+
+## In progress now
+
+Each feature below is a [milestone](https://github.com/tangency-labs/solidcraft/milestones) holding
+the issues for it, so the count shows how far along it is. Counts are as of 2026-10-25, one per
+feature or request. Work merged on a feature branch (`drawings`, `render`) counts as built but
+reaches the app only when that branch merges. They are rough, not a promise.
+
+- **[Rendering & materials](https://github.com/tangency-labs/solidcraft/milestone/17)**: in progress, 9 of 34 pieces done, 3 of them built only on the `render` branch and in the app when it merges. The basic Render workspace is already in releases (0.22.0); the interface rework (#6281) and the material and light libraries are what is left.
+- **[Drawings](https://github.com/tangency-labs/solidcraft/milestone/8)**: in progress, 3 of 21 pieces built (2 in releases, 1 on the `drawings` branch), and 3 more partly built there (sheets and borders, bill-of-materials types, the paper scene). Not in the app yet: it lands when the `drawings` branch merges. Today you can export the current view as a DXF.
+- **[Sheet metal](https://github.com/tangency-labs/solidcraft/milestone/15)**: in progress, 1 of 30 requests done. Flanges, hems, unfold and flat patterns already work; the 30 are extensions, mostly the per-edge flange options (segments, miters, partial flanges, reliefs) and bend allowance.
+- **[Sketching](https://github.com/tangency-labs/solidcraft/milestone/14)**: in progress, 12 of 50 pieces done. Dimension types, selection and snapping options.
+- **[Solid modeling](https://github.com/tangency-labs/solidcraft/milestone/2)**: in progress, 9 of 50 pieces done. Blends, holes, threads and patterns.
+- **[Assemblies & joints](https://github.com/tangency-labs/solidcraft/milestone/3)**: in progress, 4 of 19 pieces done. Joints, motion studies and exploded views already work; placement rules, linked sub-assemblies, fastener stacks and weldment corners are the pieces left.
+- **[Import & export](https://github.com/tangency-labs/solidcraft/milestone/5)**: in progress, 7 of 39 pieces done. FreeCAD, SolidWorks and point-cloud import, and mesh export options.
+- **[AI agents & MCP](https://github.com/tangency-labs/solidcraft/milestone/18)**: in progress, 2 of 8 pieces done. Agent chat and the MCP server.
+- **[Interface, web app & plugins](https://github.com/tangency-labs/solidcraft/milestone/4)**: in progress, 31 of 96 pieces done. Ribbon redesign, navigation, themes, the web app and plugins.
+- **[SMLib kernel migration](https://github.com/tangency-labs/solidcraft/milestone/1)**: in progress, 1 tracking issue open. The kernel is moving from truck to NVIDIA's SMLib (usd-brep, Apache-2.0) on the `kernel-smlib` branch; it is not in releases yet. Tracked in [#4012](https://github.com/tangency-labs/solidcraft/issues/4012).
+
+## Next
+
+- **[Surfacing](https://github.com/tangency-labs/solidcraft/milestone/16)**: next, 6 of 14 pieces done. Patch, trim, blend and match exist; the rest of the surface toolset is planned.
+- **[Manufacturing / CAM](https://github.com/tangency-labs/solidcraft/milestone/9)**: next, 1 pieces tracked, none done. There is no CAM in SolidCraft yet. Send to Slicer and a first toolpath slice are in review; proposals are [#1153](https://github.com/tangency-labs/solidcraft/issues/1153) and [#1621](https://github.com/tangency-labs/solidcraft/issues/1621).
+
+Features are not tied to a release or a date. Work lands in the daily releases as it is finished.
+Anything without a milestone, such as bug fixes, is not a feature and is not listed here.
+
+## How releases work
+
+- Releases ship daily, as numbered versions (v0.22.0, v0.22.1) with nightly pre-releases in
+  between. They are delivered through the in-app updater.
+- SolidCraft tells you when a newer stable release exists and never updates without asking.
+  Where it can replace itself safely (AppImage, Windows installer and portable builds) there is
+  an **Update now** button; downloads are checked against the release's SHA-256 list. See
+  [updates and privacy](docs/book/src/guide/updates.md).
+- Design files carry a format number. A new version opens designs from older versions, but an
+  older version refuses a design saved by a newer one (0.22.0 writes format 35, and 0.21.0 and
+  earlier will not open it). Each release's notes say when the format changed. Keep a copy of
+  an important design before you move to a new version.
+
+## Licence
+
+SolidCraft is licensed MIT OR Apache-2.0, at your option; see [LICENSE-MIT](LICENSE-MIT) and
+[LICENSE-APACHE](LICENSE-APACHE). Versions already released stay available under those licences
+permanently.
+
+## How to follow along
+
+- Feature milestones: <https://github.com/tangency-labs/solidcraft/milestones>
+- Issues: <https://github.com/tangency-labs/solidcraft/issues> (area labels such as
+  `area:kernel`, `area:sketch` and `area:ui` group them)
+- Discord: <https://discord.gg/FtU4NQNVDH>
+- Releases: <https://github.com/tangency-labs/solidcraft/releases>
+- Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
@@ -1,6 +1,6 @@
 Third-party software in SolidCraft

-SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 559 crates below.
+SolidCraft (the desktop app, solidcraft-cli and the web app) is built from the 560 crates below.
 Generated by `cargo xtask licences` from Cargo.lock and the crates' own licence files.
 SolidCraft's own licence is in LICENSE-MIT and LICENSE-APACHE, and NOTICE.

@@ -439,6 +439,7 @@ typed-path 0.12.3  (MIT OR Apache-2.0)
 typeid 1.0.3  (MIT OR Apache-2.0)
 typenum 1.20.1  (MIT OR Apache-2.0)
 uds_windows 1.2.1  (MIT)
+unicode-bidi 0.3.18  (MIT OR Apache-2.0)
 unicode-general-category 1.1.0  (Apache-2.0)
 unicode-ident 1.0.26  ((MIT OR Apache-2.0) AND Unicode-3.0)
 unicode-segmentation 1.13.3  (MIT OR Apache-2.0)
@@ -1123,9 +1124,9 @@ parking_lot_core 0.9.12, percent-encoding 2.3.2, piper 0.2.5, plain 0.2.3, png 0
 rustls-native-certs 0.8.5, scoped-tls 1.0.1, scopeguard 1.2.0, secret-service 4.0.0,
 security-framework 2.11.1, security-framework 3.7.0, security-framework-sys 2.17.0,
 signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.16.2, smol_str 0.2.2, stable_deref_trait
-1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-segmentation 1.13.3, unicode-width
-0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12,
-wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
+1.2.1, syn 1.0.109, tempfile 3.27.0, ttf-parser 0.25.1, unicode-bidi 0.3.18, unicode-segmentation
+1.13.3, unicode-width 0.2.2, url 2.5.8, uuid 1.27.0, wasi 0.11.1+wasi-snapshot-preview1, wasip2
+1.0.4+wasi-0.2.12, wasm-bindgen 0.2.129, wasm-bindgen-futures 0.4.79, wasm-bindgen-macro 0.2.129,
 wasm-bindgen-macro-support 0.2.129, wasm-bindgen-shared 0.2.129, web-sys 0.3.106, weezl 0.1.12,
 wit-bindgen 0.57.1
 ================================================================================
@@ -14524,6 +14525,49 @@ MIT License
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE

+================================================================================
+unicode-bidi 0.3.18
+================================================================================
+
+This project is copyright 2015, The Servo Project Developers (given in the
+file AUTHORS).
+
+Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+http://www.apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+http://opensource.org/licenses/MIT>, at your option. All files in the project
+carrying such notice may not be copied, modified, or distributed except
+according to those terms.
+
+================================================================================
+unicode-bidi 0.3.18, unicode-segmentation 1.13.3, unicode-width 0.2.2
+================================================================================
+
+Copyright (c) 2015 The Rust Project Developers
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
 ================================================================================
 unicode-ident 1.0.26
 ================================================================================
@@ -14572,36 +14616,6 @@ authorization of the copyright holder.
 unicode-segmentation 1.13.3, unicode-width 0.2.2
 ================================================================================

-Copyright (c) 2015 The Rust Project Developers
-
-Permission is hereby granted, free of charge, to any
-person obtaining a copy of this software and associated
-documentation files (the "Software"), to deal in the
-Software without restriction, including without
-limitation the rights to use, copy, modify, merge,
-publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software
-is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice
-shall be included in all copies or substantial portions
-of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
-
-================================================================================
-unicode-segmentation 1.13.3, unicode-width 0.2.2
-================================================================================
-
 Licensed under the Apache License, Version 2.0
 <LICENSE-APACHE or
 http://www.apache.org/licenses/LICENSE-2.0> or the MIT
@@ -0,0 +1,36 @@
+# SolidCraft name and logo
+
+The code is yours to use under MIT OR Apache-2.0 (see [NOTICE](NOTICE)). The name is not part of
+that licence: "SolidCraft" and the SolidCraft logo identify this project and the builds its
+maintainers publish, and Tangency Labs, which maintains SolidCraft, uses them as its trademarks.
+Neither licence grants rights to them.
+
+This page says how you can use the name. It is meant to be easy to follow: most uses are fine.
+
+## Fine without asking
+
+- Saying what your work is built on: "based on SolidCraft", "a fork of SolidCraft", "works with
+  SolidCraft", "SolidCraft plugin for …".
+- Writing, teaching, reviewing or making videos about SolidCraft, including in titles.
+- Redistributing unmodified official builds under the SolidCraft name, for example in a Linux
+  distribution or package manager.
+- Using the logo to link to the project or to show that something supports SolidCraft.
+- User groups, meetups and community spaces about SolidCraft, as long as they don't look official.
+
+## Use your own name
+
+- A fork, a modified build or a product built on SolidCraft needs its own name and logo. "SolidCraft"
+  may appear in its description ("based on SolidCraft"), not as its name or the main part of it.
+- Don't use names or logos that could be mistaken for SolidCraft, such as "SolidCraft Pro",
+  "SolidKraft" or a lightly changed version of the logo.
+- Don't imply that SolidCraft's maintainers made, endorse or support your product or service unless
+  they do.
+- Don't use the name in domain names, app store listings or social media accounts in a way that
+  looks official.
+
+## Questions
+
+If you're not sure whether a use is fine, open an issue or ask on [Discord](https://discord.gg/FtU4NQNVDH).
+For anything this page doesn't allow, ask first; we're generally happy to say yes.
+
+Other companies' trademarks named in this repository are covered in [NOTICE](NOTICE).
@@ -68,7 +68,7 @@ fn run() -> Result<(), String> {
    let generation_start = Instant::now();
    let (commands, command_timings) = session.run_script_timed(&recipe, false).map_err(|e| e.to_string())?;
    let generation_seconds = generation_start.elapsed().as_secs_f64();
-    let design_path = output.with_extension("solidcraft");
+    let design_path = output.with_extension(solidcraft_engine::io::DESIGN_EXT);
    session.execute("file.save_as", &json!({"path":design_path})).map_err(|e| e.to_string())?;
    let scene = solidcraft_engine::product_scene::extract(&session).map_err(|e| e.to_string())?;
    let bodies: Vec<Value> = scene
@@ -8,7 +8,7 @@
 //! no fixture.
 //!
 //! ```text
-//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.solidcraft]
+//! solidcraft-cli bench-agent [--scale F] [--script-out script.json] [--save design.sc]
 //! ```
 //! prints one JSON line per hundred commands (mean and max milliseconds, bodies so far), then the
 //! build total, then the phases `bench-open` prints for the saved design.
@@ -205,7 +205,10 @@ pub fn run(args: &[String]) -> Result<(), String> {
    );
    let path = match flag("--save") {
        Some(p) => p.clone(),
-        None => std::env::temp_dir().join(format!("bench-agent-{}.solidcraft", std::process::id())).to_string_lossy().into_owned(),
+        None => std::env::temp_dir()
+            .join(format!("bench-agent-{}.{}", std::process::id(), solidcraft_engine::io::DESIGN_EXT))
+            .to_string_lossy()
+            .into_owned(),
    };
    s.execute("file.save", &json!({"path": path})).map_err(|e| e.to_string())?;
    let r = crate::cmd_bench_open(std::slice::from_ref(&path));
@@ -419,7 +419,7 @@ fn wait_for_turn(control: &mut Control, mut chat: Value, began: Instant, end: In
        let idle = !matches!(state, "busy" | "starting") && !turn && !queued;
        // A turn can start and end between two polls: then the conversation has its answer.
        let answered = chat["items"].as_array().into_iter().flatten().any(|i| i.get("user").is_none());
-        if idle && (seen_busy || answered || matches!(state, "exited" | "auth" | "off") || began.elapsed() >= START_GRACE) {
+        if idle && (seen_busy || answered || matches!(state, "exited" | "failed" | "auth" | "off") || began.elapsed() >= START_GRACE) {
            return Ok((chat, false));
        }
        let Some(left) = end.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()) else { return Ok((chat, true)) };
@@ -1,10 +1,10 @@
 //! SolidCraft headless command line.
 //!
 //! ```text
-//! solidcraft-cli run <script.json|design.solidcraft|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
-//! solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE] (alias: inspect) measurements as JSON
-//! solidcraft-cli script <design.solidcraft> [--out script.json]     the design's history as a command script
-//! solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
+//! solidcraft-cli run <script.json|design.sc|part.step|mesh.3mf> [--in design|part.step|mesh.3mf] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]
+//! solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE] (alias: inspect) measurements as JSON
+//! solidcraft-cli script <design.sc> [--out script.json]     the design's history as a command script
+//! solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json] loading timings as JSON lines
 //! solidcraft-cli bench-agent [--scale F] [--save F] [--script-out F] a ~1,300-body design built command by command, timed
 //! solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N]
 //!                                 [--timeout-s 300] [--json out.json] [--markdown out.md]
@@ -56,19 +56,19 @@ struct Command {
 }

 /// `run`'s lines in the usage.
-const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.solidcraft|part.step> [--in design.solidcraft|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.solidcraft|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
+const USAGE_RUN: &str = "  solidcraft-cli run <script.json|design.sc|part.step> [--in design.sc|part.step] [--out FILE]... [--save FILE] [--quiet] [--results] [--timings] [--profile] [--json-out FILE] [--allow-errors]\n  solidcraft-cli run --in <design.sc|part.step> [--out FILE]...\n      (a timeline feature that fails fails the run and nothing is written; --allow-errors writes anyway)\n      (--timings prints {timings: [{index, command, ms}], total_ms} for a script, with --results its results too;\n       --profile adds each command's profile: {boolean_ms, tessellate_ms, other_ms}, the kernel's share)\n";
 /// `eval`'s lines in the usage.
-const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.solidcraft|part.step> [--json-out FILE]     (alias: inspect; or --in FILE)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
+const USAGE_EVAL: &str = "  solidcraft-cli eval <script.json|design.sc|part.step> [--in design.sc|part.step] [--json-out FILE]     (alias: inspect)\n  solidcraft-cli eval --in <script.json|design.sc|part.step> [--json-out FILE]\n      (with both inputs, runs the positional script on --in before measuring; does not automatically save the modified design)\n      (--json-out FILE writes the JSON that run (with --results, else the measurement) and eval print to FILE instead of stdout,\n       as plain UTF-8: a shell's > can re-encode it, e.g. Windows PowerShell adds a byte-order mark)\n";
 /// `script`'s lines in the usage.
-const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.solidcraft|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
+const USAGE_SCRIPT: &str = "  solidcraft-cli script <design.sc|script.json> [--out script.json]\n      (the design's history as a command script that eval and run replay)\n";
 /// `bench-open`'s lines in the usage.
-const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only] [--save OUT.solidcraft] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
+const USAGE_BENCH_OPEN: &str = "  solidcraft-cli bench-open <design.sc | part.step> [--parse-only] [--save OUT.sc] [--display LEVEL [--edit NAME EXPR]] [--ops script.json]\n      (--ops: after opening, run each command of the script and undo it, timing the command, the\n       evaluations it caused and the view it leaves: placing and meshing what changed)\n";
 /// `bench-agent`'s lines in the usage.
-const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.solidcraft] [--script-out script.json]\n";
+const USAGE_BENCH_AGENT: &str = "  solidcraft-cli bench-agent [--scale F] [--save design.sc] [--script-out script.json]\n";
 /// `bench-assistant`'s lines in the usage.
 const USAGE_BENCH_ASSISTANT: &str = "  solidcraft-cli bench-assistant --connect 127.0.0.1:PORT [--token T] --base-url URL --model NAME [--tasks 1,2,5] [--repeat N] [--timeout-s 300] [--json out.json] [--markdown out.md]\n";
 /// `snapshot`'s lines in the usage.
-const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.solidcraft|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.solidcraft|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
+const USAGE_SNAPSHOT: &str = "  solidcraft-cli snapshot <script|design> [--in design.sc|part.step] --out shot.png [--width W] [--height H] [--view NAME | --camera JSON] [--no-grid] [--no-axes]\n      [--body NAME:opacity=0.3,color=#rrggbb]... [--tool NAME]... [--section z=27]\n  solidcraft-cli snapshot --in <design.sc|part.step> --out shot.png ...\n      (as with run, --in starts from a design and the script runs on top of it; an option snapshot doesn't take is an error;\n       --view: iso, front, back, top, bottom, left, right, or the name of a view saved in the design with view.save;\n       --camera: {target: [x,y,z], yaw, pitch, distance, fov?} in mm and radians, as the MCP screenshot takes it (docs/mcp.md);\n       --no-grid and --no-axes leave the ground grid (on Z 0) and the origin's axes out of the picture;\n       --body: how one body is drawn, as appearance.assign takes it: opacity 0-1 (below 1 is see-through, so what is inside\n         it shows) and color #rrggbb, either or both, once per body;\n       --tool: draw this body solid in the tool colour and every other body see-through, so a cut's or a join's tool body\n         is visible inside the material it meets; a later --body overrides it;\n       --section: cut the model as inspect.section does, so the inside shows: z=27 (the plane through that world\n         coordinate, keeping the smaller side), add ,flip to keep the other side, or XY, XZ, YZ, or its own JSON)\n";
 /// `render`'s lines in the usage.
 const USAGE_RENDER: &str = "  solidcraft-cli render <script|design> --out image.png [--setup NAME] [--width W] [--height H] [--transparent] [--overwrite] [--timeout SECONDS]\n      [--progressive] [--samples N] [--max-depth N] [--seed N] [--exposure EV] [--lighting FILE.json] [--environment FILE.json] [--tone-map reinhard|aces_fitted]\n";
 /// `exec`'s lines in the usage.
@@ -83,7 +83,7 @@ const USAGE_ORACLE: &str = "  solidcraft-cli oracle <case-dir>... [--json]\n";
 const USAGE_FUZZ: &str =
    "  solidcraft-cli fuzz [--from N] [--count N] [--jobs J] [--timeout S] [--steps N] [--minimise] [--out DIR] [--report FILE]\n";
 /// `mcp`'s lines in the usage.
-const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.solidcraft|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
+const USAGE_MCP: &str = "  solidcraft-cli mcp [--headless] [--in design.sc|script.json] [--connect 127.0.0.1:PORT [--token T]] [--allow-path DIR]... [--allow-any-path]\n                     [--param-check off|warn|strict] [--render-gpu]\n  solidcraft-cli mcp setup [--dry-run] [--client opencode|claude-desktop|claude-code|cursor] [--live]\n      (adds a `solidcraft` server, with this program's path, to each installed AI client; --live adds `solidcraft-live` for the running app; alias: mcp install)\n";
 /// `crashes`'s lines in the usage.
 const USAGE_CRASHES: &str = "  solidcraft-cli crashes [list [--json] | show <id> | replay <id> | dir | clear [<id>]]\n";
 /// `licences`'s lines in the usage.
@@ -262,8 +262,7 @@ fn load_checked(path: &str, check: solidcraft_engine::schema::ParamCheck) -> Res
    let bytes = solidcraft_engine::io::vfs::read(path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| format!("{path}: {e}"))?;
    if solidcraft_engine::io::is_design_container(&bytes) {
        let doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| format!("{path}: {e}"))?;
-        let mut session = Session::new(doc);
-        session.path = Some(path.to_owned());
+        let mut session = Session::opened_at(doc, None, Some(path));
        session.param_check = check;
        return Ok(session);
    }
@@ -340,6 +339,7 @@ fn print_json(v: &Value, file: Option<&str>) -> Result<(), String> {
 fn cmd_run(args: &[String]) -> Result<(), String> {
    install_renderer();
    let json_out = json_out(args)?;
+    known_args("run", args, &["--in", "--out", "--save", "--json-out"], &["--quiet", "--results", "--timings", "--profile", "--allow-errors"], true)?;
    let base = flag(args, "--in");
    let path = positional(args);
    if path.is_none() && base.is_none() {
@@ -392,7 +392,7 @@ fn cmd_run(args: &[String]) -> Result<(), String> {
    Ok(())
 }

-/// The session `run` and `snapshot` start from: `--in` (a design or STEP file) with the
+/// The session `run`, `eval` and `snapshot` start from: `--in` (a design or STEP file) with the
 /// positional script run on top of it, or either one alone.
 fn open(base: Option<&str>, path: Option<&String>) -> Result<Session, String> {
    match (base, path) {
@@ -444,8 +444,8 @@ fn timeline_ok(s: &Session) -> Result<(), String> {

 fn cmd_eval(args: &[String]) -> Result<(), String> {
    let json_out = json_out(args)?;
-    let path = flag(args, "--in").or_else(|| positional(args).map(String::as_str)).ok_or_else(usage)?;
-    let mut s = load(path)?;
+    known_args("eval", args, &["--in", "--json-out"], &[], true)?;
+    let mut s = open(flag(args, "--in"), positional(args))?;
    let m = s.execute("inspect.measure", &json!({})).map_err(|e| e.to_string())?;
    let d = s.execute("document.inspect", &json!({})).map_err(|e| e.to_string())?;
    let out = json!({
@@ -817,7 +817,7 @@ fn bench_ops(mut s: Session, script: &str) -> Result<Session, String> {

 /// Separate file reading, JSON decoding/repair, timeline evaluation and display meshing.
 pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
-    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.solidcraft | part.step> [--parse-only]")?;
+    let path = args.first().ok_or("usage: solidcraft-cli bench-open <design.sc | part.step> [--parse-only]")?;
    let t = std::time::Instant::now();
    let step = solidcraft_engine::io::is_step_path(path);
    let limit = if step { solidcraft_engine::io::MAX_STEP_BYTES } else { solidcraft_engine::io::MAX_DESIGN_BYTES };
@@ -843,7 +843,7 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
        return Ok(());
    }
    let t = std::time::Instant::now();
-    let s = Session::opened(doc, saved.as_ref());
+    let s = Session::opened_at(doc, saved.as_ref(), (!step).then_some(path.as_str()));
    drop(read);
    // Taken from the file: nothing evaluated (SOLIDCRAFT_NO_MODEL_CACHE evaluates anyway), or
    // only the features whose state a thinned file left out.
@@ -863,13 +863,13 @@ pub(crate) fn cmd_bench_open(args: &[String]) -> Result<(), String> {
        json!({"step": "mesh", "ms": t.elapsed().as_secs_f64() * 1000.0, "place_ms": place_ms, "bodies": st.bodies.len(), "triangles": triangles})
    );
    let flag = |name: &str| args.iter().position(|a| a == name);
-    // `--save PATH`: save the opened design without its model cache (to PATH.plain.solidcraft) and
+    // `--save PATH`: save the opened design without its model cache (to PATH.plain.sc) and
    // as the app does, with it, then read the cache back.
    let s = match flag("--save").and_then(|i| args.get(i + 1)) {
        Some(out) => {
            let mut s = s;
            // Without the cache first, for comparison.
-            let plain = format!("{out}.plain.solidcraft");
+            let plain = format!("{out}.plain.{}", solidcraft_engine::io::DESIGN_EXT);
            let t = std::time::Instant::now();
            s.execute("file.save_as", &json!({"path": plain, "cache": false})).map_err(|e| e.to_string())?;
            let plain_ms = t.elapsed().as_secs_f64() * 1000.0;
@@ -92,7 +92,7 @@ fn designs() -> Vec<(String, PathBuf)> {
    add("regressions", root.join("examples/regressions"), "json");
    add("demo", root.join("examples/demo"), "json");
    add("typical", root.join("tests/action_matrix/designs"), "json");
-    add("demo", root.join("tests/action_matrix/designs"), "solidcraft");
+    add("demo", root.join("tests/action_matrix/designs"), solidcraft_engine::io::DESIGN_EXT);
    let mut cases: Vec<PathBuf> =
        std::fs::read_dir(root.join("tests/oracle")).unwrap().flatten().map(|e| e.path()).filter(|p| p.join("recipe.json").is_file()).collect();
    cases.sort();
@@ -105,7 +105,7 @@ fn designs() -> Vec<(String, PathBuf)> {
 /// Build a design from its file.
 fn load(path: &Path) -> Result<Session, String> {
    let mut s = Session::default();
-    if path.extension().is_some_and(|x| x == "solidcraft") {
+    if solidcraft_engine::io::is_design_container_path(path) {
        s.execute("doc.open", &json!({"path": path.to_string_lossy()})).map_err(|e| e.to_string())?;
        return Ok(s);
    }
@@ -395,8 +395,10 @@ fn actions(s: &Session) -> Vec<Action> {
            let r = round3((shortest * 0.1).max(0.01));
            let mut add = |action, act| out.push(Action { entity: entity.clone(), action, act });
            if !smooth(e, mid) {
-                add("edge.fillet", Act::Run("solid.fillet", json!({"edges": [pt(mid)], "radius": r})));
-                add("edge.chamfer", Act::Run("solid.chamfer", json!({"edges": [pt(mid)], "distance": r})));
+                // The midpoint is interior to this edge, but other bodies (including component
+                // copies in their local frames) can have coincident edges. Retain the picked body.
+                add("edge.fillet", Act::Run("solid.fillet", json!({"body": world, "edges": [pt(mid)], "radius": r})));
+                add("edge.chamfer", Act::Run("solid.chamfer", json!({"body": world, "edges": [pt(mid)], "distance": r})));
            }
            let dir = straight(pts);
            if dir.is_some() {
@@ -1278,6 +1280,41 @@ fn rectangle(plane: Value, p0: [f64; 2], p1: [f64; 2]) -> [Value; 3] {
    ]
 }

+#[test]
+fn edge_round_actions_keep_the_picked_body() {
+    for (corner, length) in [([10, 0, 20], 4), ([0, 0, 0], 20)] {
+        let mut s = Session::default();
+        s.execute("solid.box", &json!({"length": 20, "width": 20, "height": 20, "body_name": "Plate"})).unwrap();
+        s.execute(
+            "solid.box",
+            &json!({"corner": corner, "length": length, "width": length, "height": length, "body_name": "Block", "operation": "new"}),
+        )
+        .unwrap();
+        let mut tried = 0;
+        for a in actions(&s) {
+            if !a.entity.starts_with("Plate/") || !matches!(a.action, "edge.chamfer" | "edge.fillet") {
+                continue;
+            }
+            let Act::Run(id, ref p) = a.act else { continue };
+            let q = &p["edges"][0];
+            let x = q[0].as_f64().unwrap();
+            if q[1] != 0.0 || q[2] != 20.0 || !(0.0..20.0).contains(&x) {
+                continue;
+            }
+            // Block either meets this midpoint or coincides with the whole edge.
+            assert_eq!(p["body"], "Plate", "{}: {p}", a.action);
+            assert_eq!(q, &json!([10.0, 0.0, 20.0]));
+            let mut unscoped = p.clone();
+            unscoped.as_object_mut().unwrap().remove("body");
+            let err = s.scratch().execute(id, &unscoped).unwrap_err().to_string();
+            assert!(err.contains("edges meet"), "{err}");
+            perform(&mut s.scratch(), &a.act, &errors(&s)).unwrap();
+            tried += 1;
+        }
+        assert_eq!(tried, 2);
+    }
+}
+
 #[test]
 fn a_fillet_or_chamfer_on_one_edge_ending_at_a_cylinder() {
    for (cmd, size) in [("solid.fillet", "radius"), ("solid.chamfer", "distance")] {
@@ -1521,7 +1558,7 @@ fn sketches_on_loft_and_sweep_faces() {
 #[test]
 fn press_pull_on_the_pi_case_floor() {
    reproduces(
-        Some("tests/action_matrix/designs/pi-case.solidcraft"),
+        Some("tests/action_matrix/designs/pi-case.sc"),
        json!([{"command": "solid.press_pull", "params": {"face": [30, 20, 0], "distance": 1}}]),
    );
 }
@@ -139,11 +139,13 @@ fn eval_json_out_holds_what_stdout_would() {
 fn json_out_needs_a_file_and_fails_when_it_cannot_write() {
    let dir = Scratch::new();
    let script = dir.script();
-    for cmd in ["run", "eval"] {
-        let output = cli().arg(cmd).arg(&script).arg("--json-out").output().unwrap();
-        assert_eq!(output.status.code(), Some(1), "{cmd}");
-        assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
-        assert!(output.stdout.is_empty(), "{cmd}");
+    for cmd in ["run", "eval", "inspect"] {
+        for trailing in [&[][..], &["--in"][..]] {
+            let output = cli().arg(cmd).arg(&script).arg("--json-out").args(trailing).output().unwrap();
+            assert_eq!(output.status.code(), Some(1), "{cmd}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains("--json-out needs a FILE"), "{cmd}");
+            assert!(output.stdout.is_empty(), "{cmd}");
+        }

        let missing = dir.0.join("missing").join("out.json");
        let output = cli().arg(cmd).arg(&script).arg("--json-out").arg(&missing).output().unwrap();
@@ -75,12 +75,15 @@ fn designs() -> Vec<(String, Session)> {
            .unwrap()
            .flatten()
            .map(|e| e.path())
-            .filter(|p| p.extension().is_some_and(|x| x == "solidcraft" || x == "json") && !p.to_string_lossy().ends_with(".expected.json"))
+            .filter(|p| {
+                (solidcraft_engine::io::is_design_container_path(p) || p.extension().is_some_and(|x| x == "json"))
+                    && !p.to_string_lossy().ends_with(".expected.json")
+            })
            .collect();
        files.sort();
        for p in files {
            let name = p.file_stem().unwrap_or_default().to_string_lossy().to_string();
-            let s = if p.extension().is_some_and(|x| x == "solidcraft") {
+            let s = if solidcraft_engine::io::is_design_container_path(&p) {
                open(&p)
            } else {
                let mut s = Session::default();
@@ -150,7 +153,7 @@ fn pi_case_faces_per_step_at_both_heights() {
    const FACES: [(usize, usize); 13] =
        [(2, 6), (3, 10), (4, 19), (5, 19), (6, 25), (7, 43), (8, 43), (9, 55), (10, 55), (11, 59), (12, 59), (13, 63), (14, 79)];
    let dir = scratch_dir("pi");
-    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.solidcraft")).unwrap()).unwrap();
+    let design: Value = serde_json::from_slice(&std::fs::read(root().join("tests/action_matrix/designs/pi-case.sc")).unwrap()).unwrap();
    let at = |height: &str, file: &str| {
        let mut d = design.clone();
        for p in d["params"].as_array_mut().unwrap() {
@@ -22,6 +22,19 @@ impl Scratch {
        std::fs::write(&path, json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}}]}).to_string()).unwrap();
        path
    }
+
+    fn saving_script(&self) -> (PathBuf, PathBuf) {
+        let path = self.0.join("saving.json");
+        let saved = self.0.join("script-ran.solidcraft");
+        std::fs::write(
+            &path,
+            json!({"commands": [{"command": "solid.box", "params": {"length": 2, "width": 3, "height": 4}},
+                {"command": "file.save_as", "params": {"path": saved}}]})
+            .to_string(),
+        )
+        .unwrap();
+        (path, saved)
+    }
 }

 impl Drop for Scratch {
@@ -43,10 +56,96 @@ fn body_count(path: &Path) -> Value {
    json_output(cli().arg("eval").arg(path).output().unwrap())["body_count"].clone()
 }

+#[test]
+fn run_rejects_invalid_options_before_script_execution_or_output_writes() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--out"][..], "--out needs a value"),
+        (&["--save"][..], "--save needs a value"),
+        (&["--in"][..], "--in needs a value"),
+        (&["--out", "--quiet"][..], "--out needs a value"),
+        (&["--ouut", "part.step"][..], "doesn't take --ouut"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for existing in [false, true] {
+        let saved = dir.0.join(format!("{existing}.solidcraft"));
+        let exported = dir.0.join(format!("{existing}.step"));
+        let report = dir.0.join(format!("{existing}.json"));
+        let outputs = [&saved, &exported, &report];
+        if existing {
+            for path in outputs {
+                std::fs::write(path, b"existing output").unwrap();
+            }
+        }
+        for (extra, message) in cases {
+            let output = cli()
+                .arg("run")
+                .arg(&script)
+                .arg("--save")
+                .arg(&saved)
+                .arg("--out")
+                .arg(&exported)
+                .arg("--json-out")
+                .arg(&report)
+                .args(extra)
+                .output()
+                .unwrap();
+            assert_eq!(output.status.code(), Some(1), "{extra:?}");
+            assert!(String::from_utf8_lossy(&output.stderr).contains(message), "{extra:?}: {}", String::from_utf8_lossy(&output.stderr));
+            assert!(output.stdout.is_empty());
+            assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+            for path in outputs {
+                if existing {
+                    assert_eq!(std::fs::read(path).unwrap(), b"existing output");
+                } else {
+                    assert!(!path.exists());
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_and_inspect_reject_invalid_options_before_script_execution_or_reporting() {
+    let dir = Scratch::new();
+    let (script, script_saved) = dir.saving_script();
+    let cases = [
+        (&["--in"][..], "--in needs a value"),
+        (&["--in", "--quiet"][..], "--in needs a value"),
+        (&["--out", "part.step"][..], "doesn't take --out"),
+        (&["--unknown"][..], "doesn't take --unknown"),
+    ];
+    for command in ["eval", "inspect"] {
+        for existing in [false, true] {
+            let report = dir.0.join(format!("{command}-{existing}.json"));
+            if existing {
+                std::fs::write(&report, b"existing report").unwrap();
+            }
+            for (extra, message) in cases {
+                let output = cli().arg(command).arg(&script).arg("--json-out").arg(&report).args(extra).output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command} {extra:?}");
+                assert!(
+                    String::from_utf8_lossy(&output.stderr).contains(message),
+                    "{command} {extra:?}: {}",
+                    String::from_utf8_lossy(&output.stderr)
+                );
+                assert!(output.stdout.is_empty());
+                assert!(!script_saved.exists(), "invalid arguments must be rejected before the script runs");
+                if existing {
+                    assert_eq!(std::fs::read(&report).unwrap(), b"existing report");
+                } else {
+                    assert!(!report.exists());
+                }
+            }
+        }
+    }
+}
+
 #[test]
 fn cli_loads_both_design_encodings_by_contents() {
    let dir = Scratch::new();
-    for extension in ["solidcraft", "solvecraft", "json"] {
+    for extension in ["sc", "solidcraft", "solvecraft", "json"] {
        let saved = dir.0.join(format!("box.{extension}"));
        json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&saved).output().unwrap());
        let bytes = std::fs::read(&saved).unwrap();
@@ -168,6 +267,110 @@ fn results_with_base_design_and_quiet_still_report_and_save() {
    assert_eq!(body_count(&base), 1);
 }

+/// `eval` and its alias must measure the script applied to the input design, rather than
+/// silently reporting the input alone (#6861).
+#[test]
+fn eval_runs_its_script_on_the_in_design() {
+    let dir = Scratch::new();
+    let base = dir.0.join("base.solidcraft");
+    let script = dir.0.join("add.json");
+    json_output(cli().arg("run").arg(dir.script()).arg("--save").arg(&base).output().unwrap());
+    let original = std::fs::read(&base).unwrap();
+    std::fs::write(
+        &script,
+        json!({"commands": [{"command": "solid.box", "params": {"length": 5, "width": 3, "height": 4, "corner": [10, 0, 0]}}]}).to_string(),
+    )
+    .unwrap();
+    for command in ["eval", "inspect"] {
+        // Both existing one-input forms still measure just the original body.
+        for input in [&base, &dir.script()] {
+            for named_input in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if named_input {
+                    c.arg("--in");
+                }
+                let measured = json_output(c.arg(input).output().unwrap());
+                assert_eq!(measured["body_count"], 1);
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 24.0).abs() < 1e-6);
+            }
+        }
+        for input_first in [false, true] {
+            for to_file in [false, true] {
+                let mut c = cli();
+                c.arg(command);
+                if input_first {
+                    c.arg("--in").arg(&base).arg(&script);
+                } else {
+                    c.arg(&script).arg("--in").arg(&base);
+                }
+                let report = dir.0.join("measurement.json");
+                if to_file {
+                    c.arg("--json-out").arg(&report);
+                }
+                let output = c.output().unwrap();
+                let measured = if to_file {
+                    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+                    assert!(output.stdout.is_empty());
+                    serde_json::from_slice(&std::fs::read(&report).unwrap()).unwrap()
+                } else {
+                    json_output(output)
+                };
+                assert_eq!(measured["body_count"], 2, "{command}, input_first={input_first}, to_file={to_file}");
+                assert!((measured["total"]["volume_mm3"].as_f64().unwrap() - 84.0).abs() < 1e-6);
+                assert_eq!(measured["timeline"].as_array().unwrap().len(), 2, "the script runs exactly once");
+                assert_eq!(std::fs::read(&base).unwrap(), original, "evaluation never saves its changes to the input");
+            }
+        }
+    }
+}
+
+#[test]
+fn eval_propagates_script_errors_before_writing_a_report() {
+    let dir = Scratch::new();
+    let base = dir.script();
+    let script = dir.0.join("bad.json");
+    for command in ["eval", "inspect"] {
+        for contents in ["{", r#"{"commands":[{"command":"missing.command","params":{}}]}"#] {
+            std::fs::write(&script, contents).unwrap();
+            let report = dir.0.join("report.json");
+            let output = cli().arg(command).arg(&script).arg("--in").arg(&base).arg("--json-out").arg(&report).output().unwrap();
+            assert_eq!(output.status.code(), Some(1));
+            assert!(!output.stderr.is_empty());
+            assert!(output.stdout.is_empty());
+            assert!(!report.exists());
+        }
+    }
+}
+
+#[test]
+fn eval_rejects_unknown_options_and_missing_input_values_before_writing_a_report() {
+    let dir = Scratch::new();
+    let script = dir.script();
+    let report = dir.0.join("report.json");
+    for command in ["eval", "inspect"] {
+        for (options, message) in [(&["--frobnicate", "1"][..], "doesn't take --frobnicate"), (&["--in"][..], "--in needs a value")] {
+            for options_first in [false, true] {
+                std::fs::write(&report, b"previous report").unwrap();
+                let mut c = cli();
+                c.arg(command);
+                if options_first {
+                    c.args(options).arg("--json-out").arg(&report).arg(&script);
+                } else {
+                    c.arg(&script).args(options).arg("--json-out").arg(&report);
+                }
+                // A following option also proves that --in cannot consume a flag as its value.
+                let output = c.output().unwrap();
+                assert_eq!(output.status.code(), Some(1), "{command}, {options:?}");
+                let error = String::from_utf8_lossy(&output.stderr);
+                assert!(error.contains(message), "{command}: {error}");
+                assert!(output.stdout.is_empty());
+                assert_eq!(std::fs::read(&report).unwrap(), b"previous report");
+            }
+        }
+    }
+}
+
 #[test]
 fn results_propagate_output_errors() {
    let dir = Scratch::new();
@@ -209,6 +412,11 @@ fn legacy_extension_and_format_tag_still_open() {
    assert_eq!(body_count(&resaved), 2);
    let reopened = solidcraft_engine::io::read_design(&std::fs::read(&resaved).unwrap()).unwrap();
    assert!(reopened.to_json().contains("\"solidcraft/"));
+    // `.solidcraft` (before `.sc`) opens as `--in` and as the design to evaluate; `.sc` too.
+    let current = dir.0.join("current.sc");
+    json_output(cli().args(["run", "--in"]).arg(&resaved).arg(dir.script()).arg("--save").arg(&current).output().unwrap());
+    assert_eq!(body_count(&current), 3);
+    assert!(solidcraft_engine::io::is_design_container(&std::fs::read(&current).unwrap()), "a .sc file is a design container");
 }

 /// `snapshot` starts from `--in` as `run` does (its script runs on that design), and refuses an
@@ -1,5 +1,5 @@
 //! Straight edges stay one edge after many cuts (#1049). The owner's design
-//! (`tests/action_matrix/designs/crazy-geom-cuts.solidcraft`, saved by 0.10.0): five extrudes,
+//! (`tests/action_matrix/designs/crazy-geom-cuts.sc`, saved by 0.10.0): five extrudes,
 //! joins and cuts, over four sketches, three of them on faces of the body with the faces'
 //! edges projected. Cuts used to leave the straight edges of the walls they sliced split at
 //! vertices nothing else used, so an edge that is one straight line was drawn (and lit on hover)
@@ -14,7 +14,7 @@ use solidcraft_engine::doc::kernel::{FaceSurface, face_surface};
 use solidcraft_engine::geom::Vec3;

 fn design() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.solidcraft")
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/action_matrix/designs/crazy-geom-cuts.sc")
 }

 fn open(path: &Path) -> Session {
@@ -22,6 +22,8 @@ solidcraft-engine = { workspace = true }
 solidcraft-ui-egui = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
+url = "2"
+percent-encoding = "2"

 [target.'cfg(target_arch = "wasm32")'.dependencies]
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
@@ -34,5 +36,6 @@ web-sys = { version = "0.3", features = [
    "FileSystemHandle", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemGetFileOptions", "FileSystemWritableFileStream",
    "WritableStream", "File", "FileList", "Blob", "BlobPropertyBag", "Url", "HtmlAnchorElement", "HtmlInputElement", "Storage",
    "IdbFactory", "IdbDatabase", "IdbObjectStore", "IdbOpenDbRequest", "IdbRequest", "IdbTransaction", "IdbTransactionMode",
-    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "MediaQueryList", "Gamepad", "Performance",
+    "Headers", "ReadableStream", "ReadableStreamDefaultReader",
+    "BeforeUnloadEvent", "Event", "EventTarget", "KeyboardEvent", "Response", "FormData", "RequestInit", "MediaQueryList", "Gamepad", "Performance",
 ] }
@@ -27,12 +27,12 @@
  <!-- Installable as an app (manifest.webmanifest); the icons are the Linux exports of the app mark. -->
  <meta name="theme-color" content="#343840">
  <link rel="manifest" href="manifest.webmanifest">
-  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/ai.storyteller.solidcraft.png">
-  <link rel="apple-touch-icon" href="icons/256x256/ai.storyteller.solidcraft.png">
+  <link rel="icon" type="image/png" sizes="32x32" href="icons/32x32/io.tangencylabs.solidcraft.png">
+  <link rel="apple-touch-icon" href="icons/256x256/io.tangencylabs.solidcraft.png">
  <link data-trunk rel="copy-file" href="manifest.webmanifest" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/ai.storyteller.solidcraft.png" data-target-path="icons/32x32" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/ai.storyteller.solidcraft.png" data-target-path="icons/256x256" />
-  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/ai.storyteller.solidcraft.png" data-target-path="icons/512x512" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/32x32/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/32x32" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/256x256/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/256x256" />
+  <link data-trunk rel="copy-file" href="../../assets/icons/app/linux/exports/hicolor/512x512/apps/io.tangencylabs.solidcraft.png" data-target-path="icons/512x512" />
 </head>
 <body>
  <canvas id="solidcraft_canvas"></canvas>
@@ -9,8 +9,8 @@
  "theme_color": "#343840",
  "categories": ["productivity", "utilities"],
  "icons": [
-    { "src": "icons/32x32/ai.storyteller.solidcraft.png", "sizes": "32x32", "type": "image/png" },
-    { "src": "icons/256x256/ai.storyteller.solidcraft.png", "sizes": "256x256", "type": "image/png" },
-    { "src": "icons/512x512/ai.storyteller.solidcraft.png", "sizes": "512x512", "type": "image/png" }
+    { "src": "icons/32x32/io.tangencylabs.solidcraft.png", "sizes": "32x32", "type": "image/png" },
+    { "src": "icons/256x256/io.tangencylabs.solidcraft.png", "sizes": "256x256", "type": "image/png" },
+    { "src": "icons/512x512/io.tangencylabs.solidcraft.png", "sizes": "512x512", "type": "image/png" }
  ]
 }
@@ -114,10 +114,70 @@ pub fn opens_design(extensions: &[&str]) -> bool {
    extensions.is_empty() || extensions.iter().any(|e| solidcraft_engine::io::DESIGN_EXTS.contains(e))
 }

-/// The file type a Save As dialog offers for `name`: (description, MIME type, extension).
-pub fn save_type(name: &str) -> (&'static str, &'static str, &'static str) {
-    let json = std::path::Path::new(name).extension().is_some_and(|e| e.eq_ignore_ascii_case("json"));
-    if json { ("Plain JSON design", "application/json", ".json") } else { ("SolidCraft design", "application/octet-stream", ".solidcraft") }
+/// Where an Open for `extensions` (what the command reads; `&[]`: anything) is answered.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum OpenRoute {
+    /// The browser's open dialog for a design: the file keeps its handle, so Save writes back.
+    Disk,
+    /// The "Files in this browser" window, where the browser can't open a design from the disk.
+    Panel,
+    /// A plain file input that offers these types: the file is read into the engine's files and
+    /// the command runs on it (Insert DXF or SVG, images, meshes, imported settings).
+    Upload,
+}
+
+/// Choose how an Open for `extensions` asks for its file; `api`: the browser can open a file
+/// from the disk and keep its handle.
+pub fn open_route(api: bool, extensions: &[&str]) -> OpenRoute {
+    match (opens_design(extensions), api) {
+        (true, true) => OpenRoute::Disk,
+        (true, false) => OpenRoute::Panel,
+        (false, _) => OpenRoute::Upload,
+    }
+}
+
+/// The `accept` list of a file input for `extensions` (with or without their dot): ".dxf,.svg".
+pub fn accept_list(extensions: &[&str]) -> String {
+    let list: Vec<String> = extensions
+        .iter()
+        .map(|e| e.trim().trim_start_matches('.'))
+        .filter(|e| !e.is_empty())
+        .map(|e| format!(".{}", e.to_ascii_lowercase()))
+        .collect();
+    list.join(",")
+}
+
+/// The `accept` of a file input for `extensions` on this device (`apple_touch`: an iPhone or
+/// iPad). The picker there offers only files of a type the system knows from the list and greys
+/// out the rest, `.solidcraft` designs among them, since no system type has that extension
+/// (#6977). So it offers every file there, and the opener checks what it gets.
+pub fn input_accept(extensions: &[&str], apple_touch: bool) -> String {
+    if apple_touch { String::new() } else { accept_list(extensions) }
+}
+
+/// The browser runs on an iPhone or iPad (every browser there is WebKit), from its
+/// `navigator.userAgent` and `navigator.maxTouchPoints`. iPadOS presents itself as a Mac; only its
+/// touch screen tells them apart.
+pub fn apple_touch(user_agent: &str, touch_points: i32) -> bool {
+    ["iPhone", "iPad", "iPod"].iter().any(|d| user_agent.contains(d)) || (user_agent.contains("Macintosh") && touch_points > 1)
+}
+
+/// The largest file an upload for `extensions` reads: images go into a canvas, which has a size
+/// limit, so a bigger one is refused before it is read. `None`: the importer checks the file.
+pub fn upload_limit(extensions: &[&str]) -> Option<usize> {
+    let image = |e: &&str| ["png", "jpg", "jpeg"].contains(&e.trim_start_matches('.').to_ascii_lowercase().as_str());
+    (!extensions.is_empty() && extensions.iter().all(image)).then_some(solidcraft_engine::doc::canvas::MAX_CANVAS_BYTES)
+}
+
+/// The file type a Save As dialog offers for `name`: (description, MIME type, extension). A
+/// design is `.sc` unless the name already has an older design extension, which it keeps.
+pub fn save_type(name: &str) -> (&'static str, &'static str, String) {
+    let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+    match ext.as_deref() {
+        Some("json") => ("Plain JSON design", "application/json", ".json".into()),
+        Some(e) if solidcraft_engine::io::is_design_ext(e) => ("SolidCraft design", "application/octet-stream", format!(".{e}")),
+        _ => ("SolidCraft design", "application/octet-stream", format!(".{}", solidcraft_engine::io::DESIGN_EXT)),
+    }
 }

 /// Is this a cancelled dialog (the browser's `AbortError`)? Not an error to show.
@@ -140,7 +200,7 @@ mod web {
    use wasm_bindgen_futures::{JsFuture, spawn_local};
    use web_sys::{FileSystemFileHandle, IdbDatabase, IdbObjectStore, IdbOpenDbRequest, IdbRequest, IdbTransactionMode};

-    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, opens_design, parse, path, plan_prune, save_type};
+    use super::{HANDLE_MAX_AGE_MS, is_abort, make_id, parse, path, plan_prune, save_type};
    use crate::files::{Files, err, read_handle};

    const DB: &str = "solidcraft-disk-handles";
@@ -209,7 +269,7 @@ mod web {
        let options = Object::new();
        let _ = Reflect::set(&options, &"suggestedName".into(), &name.into());
        let (description, mime, extension) = save_type(name);
-        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, extension));
+        let _ = Reflect::set(&options, &"types".into(), &types(description, mime, &extension));
        options
    }

@@ -294,7 +354,9 @@ mod web {
        let options = Object::new();
        let _ = Reflect::set(&options, &"multiple".into(), &JsValue::FALSE);
        let extensions = Array::new();
-        for e in [".solidcraft", ".solvecraft", ".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm"] {
+        let designs = solidcraft_engine::io::DESIGN_EXTS.iter().map(|e| format!(".{e}"));
+        let others = [".json", ".step", ".stp", ".3mf", ".stl", ".obj", ".glb", ".gltf", ".fcstd", ".3dm", ".dxf", ".svg"].map(String::from);
+        for e in designs.chain(others) {
            extensions.push(&e.into());
        }
        let accept = Object::new();
@@ -315,11 +377,6 @@ mod web {
        p
    }

-    /// Does an Open for `extensions` use the browser's open dialog?
-    pub fn handles_open(extensions: &[&str]) -> bool {
-        supported() && opens_design(extensions)
-    }
-
    // ---- writing ------------------------------------------------------------------------

    /// Queue what a command wrote to a disk path. Writes go one at a time; a newer write of the
@@ -577,6 +634,8 @@ mod tests {
        assert_eq!(route("/disk/18f-2a/Bracket.solidcraft"), WriteTo::Disk);
        assert_eq!(route("/downloads/part.step"), WriteTo::Download);
        assert_eq!(route("/upload/part.step"), WriteTo::Memory);
+        // The temporary folder (a screenshot without a path, #7192) stays in memory.
+        assert_eq!(route(&format!("{}/solidcraft-shot.png", solidcraft_engine::io::vfs::BROWSER_TEMP)), WriteTo::Memory);
    }

    #[test]
@@ -615,17 +674,55 @@ mod tests {
    #[test]
    fn only_design_opens_use_the_disk_dialog() {
        assert!(opens_design(&[]));
+        assert!(opens_design(&["sc"]));
        assert!(opens_design(&["solidcraft"]));
        assert!(opens_design(&["solvecraft"]));
        assert!(!opens_design(&["step", "stp"]));
        assert!(!opens_design(&["json"]));
    }

+    /// Insert DXF or SVG, images and other non-design files get a file input that offers their
+    /// types in every browser (#2052); designs keep the disk dialog or the browser's files.
+    #[test]
+    fn opens_of_other_files_use_a_file_input_for_their_types() {
+        assert_eq!(open_route(true, &["dxf"]), OpenRoute::Upload);
+        assert_eq!(open_route(false, &["png", "jpg", "jpeg"]), OpenRoute::Upload);
+        assert_eq!(open_route(true, &[]), OpenRoute::Disk);
+        assert_eq!(open_route(false, &["solidcraft"]), OpenRoute::Panel);
+        assert_eq!(accept_list(&["dxf"]), ".dxf");
+        assert_eq!(accept_list(&["png", ".JPG", "", "jpeg"]), ".png,.jpg,.jpeg");
+        assert_eq!(accept_list(&[]), "");
+        assert!(upload_limit(&["png", "jpg", "jpeg"]).is_some());
+        assert_eq!(upload_limit(&["dxf"]), None);
+    }
+
+    /// An iPhone or iPad greys out a `.solidcraft` design the `accept` list names, as it knows no
+    /// type for that extension, so its inputs offer every file; other devices keep the list (#6977).
+    #[test]
+    fn file_inputs_on_an_iphone_or_ipad_offer_every_file() {
+        let iphone =
+            "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1";
+        let mac = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15";
+        let chrome_ios = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/138.0.7204.156 Mobile/15E148 Safari/604.1";
+        let chrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36";
+        assert!(apple_touch(iphone, 5));
+        assert!(apple_touch(chrome_ios, 5), "every browser on iOS has the same picker");
+        assert!(apple_touch(mac, 5), "an iPad presents itself as a Mac");
+        assert!(!apple_touch(mac, 0), "a Mac has no touch screen");
+        assert!(!apple_touch(chrome, 10), "a touch screen elsewhere filters as before");
+        assert!(!apple_touch("", 0), "hostile input is just not an iPhone");
+        let designs = ["solidcraft", "json", "step"];
+        assert_eq!(input_accept(&designs, true), "");
+        assert_eq!(input_accept(&designs, false), ".solidcraft,.json,.step");
+    }
+
    #[test]
    fn the_save_dialog_offers_the_type_of_the_name() {
-        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
+        assert_eq!(save_type("Plate.sc").2, ".sc");
        assert_eq!(save_type("Plate.JSON").2, ".json");
-        assert_eq!(save_type("Plate").2, ".solidcraft");
+        assert_eq!(save_type("Plate").2, ".sc");
+        // A design opened under an older extension keeps it.
+        assert_eq!(save_type("Plate.solidcraft").2, ".solidcraft");
    }

    #[test]
@@ -0,0 +1,40 @@
+//! Open with EasyPrint in the browser: upload the model to Printables' import endpoint with
+//! `fetch` (it allows any origin) and answer with the address to open.
+
+use std::sync::mpsc::Sender;
+
+use js_sys::{Array, Uint8Array};
+use solidcraft_engine::easyprint::{IMPORT_URL, parse_import_response};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::files::err;
+
+/// Start the upload; the answer arrives on `done`.
+pub fn upload(name: &str, bytes: Vec<u8>, done: Sender<Result<String, String>>) {
+    let name = name.to_string();
+    spawn_local(async move {
+        let _ = done.send(post(&name, &bytes).await);
+    });
+}
+
+async fn post(name: &str, bytes: &[u8]) -> Result<String, String> {
+    let window = web_sys::window().ok_or("no window")?;
+    let parts = Array::new();
+    parts.push(&Uint8Array::from(bytes));
+    let blob = web_sys::Blob::new_with_u8_array_sequence(&parts).map_err(err)?;
+    let form = web_sys::FormData::new().map_err(err)?;
+    form.append_with_blob_and_filename("file", &blob, name).map_err(err)?;
+    form.append_with_str("file_name", name).map_err(err)?;
+    let headers = web_sys::Headers::new().map_err(err)?;
+    headers.set("Accept", "application/json").map_err(err)?;
+    let init = web_sys::RequestInit::new();
+    init.set_method("POST");
+    init.set_body(&form);
+    init.set_headers(&headers);
+    let response = JsFuture::from(window.fetch_with_str_and_init(IMPORT_URL, &init)).await.map_err(err)?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "response cast failed".to_string())?;
+    let status = response.status();
+    let text = JsFuture::from(response.text().map_err(err)?).await.map_err(err)?;
+    parse_import_response(status, text.as_string().unwrap_or_default().as_bytes())
+}
@@ -24,11 +24,13 @@ pub const OPFS: &str = disk::OPFS_PREFIX;
 pub const DOWNLOADS: &str = disk::DOWNLOADS_PREFIX;
 /// Files brought in from the computer.
 pub const UPLOAD: &str = "/upload/";
-/// The autosave of unsaved work (in OPFS: `recovery.solidcraft` and `recovery.json`).
-const RECOVERY: &str = "recovery.solidcraft";
-/// The autosave earlier releases kept (compatibility shim, docs/compatibility.md): recovered
-/// when there is no current one.
-const LEGACY_RECOVERY: &str = "recovery.solvecraft";
+/// The autosave of unsaved work (in OPFS: `recovery.sc` and `recovery.json`), named with
+/// `solidcraft_engine::io::DESIGN_EXT`.
+const RECOVERY: &str = "recovery.sc";
+/// The autosaves earlier releases kept, newest first, one per entry of
+/// `solidcraft_engine::io::LEGACY_DESIGN_EXTS` (compatibility shim, docs/compatibility.md): the
+/// newest is recovered when there is no current one.
+const LEGACY_RECOVERY: [&str; 2] = ["recovery.solidcraft", "recovery.solvecraft"];
 const RECOVERY_META: &str = "recovery.json";

 /// What to do with a file brought in from the computer.
@@ -282,9 +284,10 @@ pub fn start(files: &Rc<Files>) {
                }
                let mut entries = Vec::new();
                let has_recovery = all.iter().any(|(n, _, _)| n == RECOVERY);
+                let legacy = (!has_recovery).then(|| LEGACY_RECOVERY.into_iter().find(|l| all.iter().any(|(n, _, _)| n == l))).flatten();
                for (name, bytes, modified) in all {
-                    if name == LEGACY_RECOVERY {
-                        if !has_recovery {
+                    if LEGACY_RECOVERY.contains(&name.as_str()) {
+                        if legacy == Some(name.as_str()) {
                            vfs::insert(&format!("{OPFS}{RECOVERY}"), bytes);
                        }
                        continue;
@@ -424,7 +427,9 @@ pub fn autosave(files: &Rc<Files>, doc: Option<(&solidcraft_engine::doc::Documen
        }
        None => spawn_local(async move {
            let _ = remove_file(RECOVERY).await;
-            let _ = remove_file(LEGACY_RECOVERY).await;
+            for legacy in LEGACY_RECOVERY {
+                let _ = remove_file(legacy).await;
+            }
            let _ = remove_file(RECOVERY_META).await;
        }),
    }
@@ -448,6 +453,18 @@ pub fn recovery_path() -> String {
    format!("{OPFS}{RECOVERY}")
 }

+/// A recovery file lives in OPFS, but its relative links belong to the original design's
+/// folder (which can be on disk). Resolve them before Open sees the temporary file location.
+pub fn prepare_recovery(original_path: Option<&str>) -> Result<String, String> {
+    let path = recovery_path();
+    let bytes = vfs::read(&path, solidcraft_engine::io::MAX_DESIGN_BYTES).map_err(|e| e.to_string())?;
+    let mut doc = solidcraft_engine::io::read_design(&bytes).map_err(|e| e.to_string())?;
+    solidcraft_engine::resolve_design_links(&mut doc, original_path);
+    let bytes = solidcraft_engine::io::write_design_container(&doc).map_err(|e| e.to_string())?;
+    vfs::insert(&path, bytes);
+    Ok(path)
+}
+
 /// Pick files on the computer: the File System Access picker where there is one, else an
 /// `<input type=file>`. Read files arrive in `files.incoming`.
 pub fn pick_from_disk(files: &Rc<Files>, intent: Intent) {
@@ -500,9 +517,10 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
    let Ok(input) = doc.create_element("input").map(|e| e.unchecked_into::<web_sys::HtmlInputElement>()) else { return };
    input.set_type("file");
    // Everything the browser build imports, from the format registry: cadmpeg is pure Rust, so
-    // FreeCAD and Rhino files are part of it.
-    let accept = solidcraft_engine::io::formats::open_extensions(true).iter().map(|e| format!(".{e}")).collect::<Vec<_>>().join(",");
-    input.set_accept(&accept);
+    // FreeCAD and Rhino files are part of it; plus the DXF and SVG drawings Open and Insert take.
+    let mut extensions = solidcraft_engine::io::formats::open_extensions(true);
+    extensions.extend(["dxf", "svg"]);
+    input.set_accept(&disk::input_accept(&extensions, apple_touch()));
    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
    let _ = input.set_attribute("style", "display:none");
    if let Some(body) = doc.body() {
@@ -527,6 +545,75 @@ fn input_picker(files: &Rc<Files>, intent: Intent) {
    input.click();
 }

+/// Ask for one file of these types (`extensions`, e.g. `["dxf"]`) with a plain file input, the
+/// dialog every browser has. The answer is the file's path in the engine's files (under
+/// [`UPLOAD`], as for a file picked in the disk dialog), so the command that asked runs on it;
+/// `None` when the dialog was closed or the file could not be read.
+pub fn pick_upload(files: &Rc<Files>, extensions: &[&str]) -> impl std::future::Future<Output = Option<String>> + use<> {
+    // Shown now, in the click: a file dialog needs the user's gesture.
+    let chosen = choose_file(&disk::input_accept(extensions, apple_touch()));
+    let limit = disk::upload_limit(extensions);
+    let files = files.clone();
+    async move {
+        let read = async {
+            let value = JsFuture::from(chosen?).await.map_err(err)?;
+            // Closing the dialog answers no file: nothing to say.
+            let Ok(file) = value.dyn_into::<web_sys::File>() else { return Ok(None) };
+            let name = file.name();
+            if limit.is_some_and(|max| !file.size().is_finite() || file.size() > max as f64) {
+                return Err(format!("{name}: the file is too large"));
+            }
+            let bytes = blob_bytes(&file).await.map_err(|e| format!("{name}: {e}"))?;
+            let path = format!("{UPLOAD}{name}");
+            vfs::insert(&path, bytes);
+            Ok(Some(path))
+        };
+        match read.await {
+            Ok(path) => path,
+            Err(e) => {
+                files.say(format!("open: {e}"), true);
+                None
+            }
+        }
+    }
+}
+
+/// The page runs on an iPhone or iPad, whose file inputs offer every file (`disk::input_accept`).
+fn apple_touch() -> bool {
+    web_sys::window().is_some_and(|w| {
+        let nav = w.navigator();
+        disk::apple_touch(&nav.user_agent().unwrap_or_default(), nav.max_touch_points())
+    })
+}
+
+/// Show a hidden `<input type=file>` offering `accept` (call in the click). The promise answers
+/// the picked `File`, or `null` when the dialog is closed (the input's `cancel` event).
+fn choose_file(accept: &str) -> Result<js_sys::Promise, String> {
+    let doc = web_sys::window().and_then(|w| w.document()).ok_or("this page can't show a file dialog")?;
+    let input = doc.create_element("input").map_err(err)?.dyn_into::<web_sys::HtmlInputElement>().map_err(|_| "no file input".to_string())?;
+    input.set_type("file");
+    input.set_accept(accept);
+    // Attached (hidden) while it is open: some browsers ignore a click on a detached input.
+    input.set_attribute("style", "display:none").map_err(err)?;
+    doc.body().ok_or("this page has no body")?.append_child(&input).map_err(err)?;
+    let promise = js_sys::Promise::new(&mut |resolve: Function, _reject: Function| {
+        // One answer for a pick or a cancel; read from the event, so it does not keep the input.
+        let done = Closure::once_into_js(move |event: web_sys::Event| {
+            let file = event.target().and_then(|t| t.dyn_into::<web_sys::HtmlInputElement>().ok()).and_then(|input| {
+                input.set_onchange(None);
+                input.set_oncancel(None);
+                input.remove();
+                input.files().and_then(|list| list.get(0))
+            });
+            let _ = resolve.call1(&JsValue::UNDEFINED, &file.map_or(JsValue::NULL, JsValue::from));
+        });
+        input.set_onchange(Some(done.unchecked_ref()));
+        input.set_oncancel(Some(done.unchecked_ref()));
+    });
+    input.click();
+    Ok(promise)
+}
+
 /// Read files dropped on the page.
 pub fn take_drops(files: &Rc<Files>, raw: &mut egui::RawInput) {
    for f in std::mem::take(&mut raw.dropped_files) {
@@ -0,0 +1,142 @@
+//! Bounded HTTPS or same-origin downloads, handed to the normal design-open command as unsaved copies.
+use std::{cell::RefCell, rc::Rc};
+
+use js_sys::{Reflect, Uint8Array};
+use solidcraft_engine::io::vfs;
+use solidcraft_ui_egui::{SolveApp, ui_kit};
+use wasm_bindgen::{JsCast as _, JsValue};
+use wasm_bindgen_futures::{JsFuture, spawn_local};
+
+use crate::{check_download_size, design_url};
+
+type Reply = Result<(String, Vec<u8>), String>;
+
+#[derive(Default)]
+pub struct Download {
+    reply: Rc<RefCell<Option<Reply>>>,
+    pending: Option<(String, Vec<u8>)>,
+}
+
+impl Download {
+    pub fn start(url: Option<&str>, ctx: &egui::Context) -> Self {
+        let download = Self::default();
+        if let Some(url) = url {
+            let url = url.to_owned();
+            let slot = download.reply.clone();
+            let ctx = ctx.clone();
+            spawn_local(async move {
+                *slot.borrow_mut() = Some(fetch(&url).await);
+                ctx.request_repaint();
+            });
+        }
+        download
+    }
+
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
+        if let Some(reply) = self.reply.borrow_mut().take() {
+            match reply {
+                Ok(file) => self.pending = Some(file),
+                Err(error) => app.set_status(format!("Could not open design link: {error}"), true),
+            }
+        }
+        if self.pending.is_none() || app.file_picker_busy() {
+            return;
+        }
+        if solidcraft_ui_egui::documents::any_dirty(app) {
+            let mut answer = None;
+            let closed = ui_kit::Window::new(egui::Id::new("open_link"), "status_warning", solidcraft_ui_egui::i18n::tr("web.open_link"))
+                .required()
+                .show_body(ctx, |ui| {
+                    ui.label(solidcraft_ui_egui::i18n::tr("web.open_link_confirm"));
+                    ui.horizontal(|ui| {
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.open"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(true);
+                        }
+                        if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("ui.cancel"), ui_kit::Button::Normal).clicked() {
+                            answer = Some(false);
+                        }
+                    });
+                });
+            match answer {
+                Some(true) => {}
+                Some(false) => {
+                    self.pending = None;
+                    return;
+                }
+                None if closed => {
+                    self.pending = None;
+                    return;
+                }
+                None => return,
+            }
+        }
+        let Some((name, bytes)) = self.pending.take() else { return };
+        // The extension selects the design loader even when the URL has no extension.
+        let path = &format!("/linked/design.{}", solidcraft_engine::io::DESIGN_EXT);
+        vfs::insert(path, bytes);
+        app.open_path(path);
+        if app.session.path.as_deref() == Some(path.as_str()) {
+            app.session.path = None;
+            app.session.doc_mut().name = name;
+            app.session.mark_unsaved();
+        } else {
+            app.set_status("Could not open design link: the downloaded file is not a valid SolidCraft design", true);
+        }
+        let _ = vfs::remove(path);
+    }
+}
+
+async fn fetch(value: &str) -> Reply {
+    let window = web_sys::window().ok_or("No browser window")?;
+    let page_origin = window.location().origin().map_err(|_| "Cannot read page origin")?;
+    let url = design_url(value, &page_origin)?;
+    let name = url.path_segments().and_then(|mut segments| segments.next_back()).filter(|name| !name.is_empty()).unwrap_or("Design");
+    let decoded = js_sys::decode_uri_component(name).ok().and_then(|name| name.as_string()).unwrap_or_else(|| name.to_owned());
+    // `arm.sc` (or a legacy `arm.solidcraft`) is named `arm`.
+    let stem = match decoded.rsplit_once('.') {
+        Some((stem, ext)) if !stem.is_empty() && solidcraft_engine::io::is_design_ext(ext) => stem,
+        _ => decoded.as_str(),
+    };
+    let name: String = stem.chars().take(255).collect();
+    let response = JsFuture::from(window.fetch_with_str(url.as_str())).await.map_err(|_| "Network request failed or the host refused CORS access")?;
+    let response: web_sys::Response = response.dyn_into().map_err(|_| "Invalid download response")?;
+    design_url(&response.url(), &page_origin).map_err(|_| "Design redirected to a URL that does not use HTTPS or the page's own origin")?;
+    if !response.ok() {
+        return Err(format!("HTTP {} {}", response.status(), response.status_text()));
+    }
+    let length = response
+        .headers()
+        .get("Content-Length")
+        .map_err(|_| "Cannot read download size")?
+        .map(|value| value.parse::<u64>().map_err(|_| "Invalid Content-Length"))
+        .transpose()?;
+    if let Some(length) = length {
+        check_download_size(0, length)?;
+    }
+    let stream = response.body().ok_or("Download has no body")?;
+    let reader: web_sys::ReadableStreamDefaultReader = stream.get_reader().dyn_into().map_err(|_| "Cannot read download stream")?;
+    let result = read(&reader).await;
+    if result.is_err() {
+        let _ = JsFuture::from(reader.cancel()).await;
+    }
+    // Fetch rejects interrupted HTTP bodies and decodes Content-Encoding. Content-Length
+    // can describe compressed bytes, so the streamed limit also checks the decoded size.
+    let bytes = result?;
+    Ok((name, bytes))
+}
+
+async fn read(reader: &web_sys::ReadableStreamDefaultReader) -> Result<Vec<u8>, String> {
+    let mut bytes = Vec::new();
+    // Bound even a stream which keeps returning empty chunks.
+    for _ in 0..1_000_000 {
+        let chunk = JsFuture::from(reader.read()).await.map_err(|_| "Download interrupted")?;
+        if Reflect::get(&chunk, &JsValue::from_str("done")).map_err(|_| "Invalid download stream")?.as_bool() == Some(true) {
+            return Ok(bytes);
+        }
+        let value = Reflect::get(&chunk, &JsValue::from_str("value")).map_err(|_| "Invalid download chunk")?;
+        let chunk: Uint8Array = value.dyn_into().map_err(|_| "Invalid download bytes")?;
+        check_download_size(bytes.len(), u64::from(chunk.length()))?;
+        bytes.extend_from_slice(&chunk.to_vec());
+    }
+    Err("Download returned too many chunks".into())
+}
@@ -11,9 +11,13 @@ mod api;
 #[cfg(any(target_arch = "wasm32", test))]
 mod disk;
 #[cfg(target_arch = "wasm32")]
+mod easyprint;
+#[cfg(target_arch = "wasm32")]
 mod files;
 #[cfg(target_arch = "wasm32")]
 mod install;
+#[cfg(target_arch = "wasm32")]
+mod linked;
 #[cfg(any(target_arch = "wasm32", test))]
 mod space_mouse;

@@ -25,6 +29,89 @@ fn browser_switches_tabs(key: &str, ctrl: bool) -> bool {
    ctrl && key == "Tab"
 }

+#[cfg(any(target_arch = "wasm32", test))]
+fn query_flag(query: &str, name: &str) -> bool {
+    url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()).any(|(key, _)| key == name)
+}
+
+/// Launch options use exact query keys; URL values are decoded only once.
+#[cfg(any(target_arch = "wasm32", test))]
+#[derive(Default, Debug)]
+struct Launch {
+    open: Option<String>,
+    embed: bool,
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+impl Launch {
+    fn parse(query: &str) -> Self {
+        let mut launch = Self::default();
+        let mut embed = false;
+        for (key, value) in url::form_urlencoded::parse(query.trim_start_matches('?').as_bytes()) {
+            match key.as_ref() {
+                "open" if launch.open.is_none() => launch.open = Some(value.into_owned()),
+                "embed" => embed = true,
+                _ => {}
+            }
+        }
+        launch.embed = embed && launch.open.is_some();
+        launch
+    }
+
+    fn persists(&self) -> bool {
+        !self.embed
+    }
+
+    fn full_app_url(&self, mut url: url::Url) -> String {
+        url.set_query(None);
+        url.set_fragment(None);
+        if let Some(open) = &self.open {
+            url.query_pairs_mut().append_pair("open", open);
+        }
+        url.to_string()
+    }
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn design_url(value: &str, page_origin: &str) -> Result<url::Url, String> {
+    if value.len() > 16_384 {
+        return Err("Design URL is too long".into());
+    }
+    let decoded = percent_encoding::percent_decode_str(value).decode_utf8().map_err(|_| "Invalid design URL encoding")?;
+    if decoded.chars().any(|ch| ch.is_control() || ch == '\\') {
+        return Err("Design links must not contain backslashes or control characters".into());
+    }
+    // Check before URL parsing normalizes away dot segments. Decode escaped slashes too.
+    let path = value.split(['?', '#']).next().unwrap_or_default();
+    let path = percent_encoding::percent_decode_str(path).collect::<Vec<_>>();
+    if path.split(|byte| *byte == b'/').any(|segment| segment == b"..") {
+        return Err("Design links must not contain parent path segments".into());
+    }
+    let page = url::Url::parse(page_origin).map_err(|_| "Invalid page origin")?;
+    let url = if value.starts_with('/') && !value.starts_with("//") {
+        page.join(value).map_err(|_| "Invalid design path")?
+    } else {
+        url::Url::parse(value).map_err(|_| "Invalid design URL")?
+    };
+    if (url.scheme() != "https" && url.origin() != page.origin())
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+    {
+        return Err("Design links must use HTTPS or the page's own origin without credentials".into());
+    }
+    Ok(url)
+}
+
+#[cfg(any(target_arch = "wasm32", test))]
+fn check_download_size(current: usize, incoming: u64) -> Result<(), String> {
+    let cap = solidcraft_engine::io::MAX_DESIGN_BYTES as u64;
+    if current as u64 > cap || incoming > cap.saturating_sub(current as u64) {
+        return Err(format!("Design exceeds the {} MB size limit", cap / (1024 * 1024)));
+    }
+    Ok(())
+}
+
 #[cfg(target_arch = "wasm32")]
 mod web {
    use std::rc::Rc;
@@ -112,6 +199,9 @@ mod web {

    struct Shell {
        app: SolveApp,
+        launch: crate::Launch,
+        linked: crate::linked::Download,
+        full_url: Option<String>,
        api: Api,
        files: Rc<Files>,
        /// When the last autosave was (seconds), and the revision it holds (none stored: `None`).
@@ -137,6 +227,9 @@ mod web {
    impl Shell {
        /// Files from the computer, writes to store, messages and the autosave.
        fn files_tick(&mut self, ctx: &egui::Context) {
+            if !self.launch.persists() {
+                return;
+            }
            if self.files.ctx.borrow().is_none() {
                *self.files.ctx.borrow_mut() = Some(ctx.clone());
            }
@@ -267,7 +360,7 @@ mod web {
                            files::pick_from_disk(&self.files, Intent::Open);
                        }
                        if ui_kit::button(ui, "Insert from computer…", ui_kit::Button::Normal)
-                            .on_hover_text("STEP, 3MF or STL into the open design")
+                            .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_drawings_hint"))
                            .clicked()
                        {
                            files::pick_from_disk(&self.files, Intent::Insert);
@@ -320,7 +413,7 @@ mod web {
                                    let design = solidcraft_engine::io::is_design_path(&e.name);
                                    if !design
                                        && ui_kit::button(ui, "Insert", ui_kit::Button::Small)
-                                            .on_hover_text("Into the open design (STEP, 3MF, STL)")
+                                            .on_hover_text(solidcraft_ui_egui::i18n::tr("web.files.insert_stored_drawings_hint"))
                                            .clicked()
                                    {
                                        act = Some(("insert", e.name.clone()));
@@ -435,15 +528,25 @@ mod web {
                    });
                });
            let Some(recover) = answer else { return };
-            *self.files.recovery.borrow_mut() = None;
            if recover {
-                self.app.open_path(&files::recovery_path());
+                let recovery = match files::prepare_recovery(path.as_deref()) {
+                    Ok(recovery) => recovery,
+                    Err(error) => {
+                        self.app.set_status(error, true);
+                        return;
+                    }
+                };
+                self.app.open_path(&recovery);
+                if self.app.session.path.as_deref() != Some(recovery.as_str()) {
+                    return;
+                }
                // It belongs to its own file again (saving goes there); it is unsaved.
                self.app.session.path = path;
                self.app.session.doc_mut().name = name;
                self.app.session.mark_unsaved();
                self.app.home.open = false;
            }
+            *self.files.recovery.borrow_mut() = None;
            files::autosave(&self.files, None);
        }

@@ -526,19 +629,42 @@ mod web {
            if let Some(delay) = self.wheel_gestures.update(raw, now) {
                ctx.request_repaint_after(delay);
            }
-            files::take_drops(&self.files, raw);
+            if self.launch.persists() {
+                files::take_drops(&self.files, raw);
+            } else {
+                raw.dropped_files.clear();
+            }
            // Before the app's own hook, which adds the control channel's events.
            self.space_mouse.raw_input_hook(ctx, self.app.preferences.space_mouse_enabled, raw);
            self.app.raw_input_hook(raw);
        }
        fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+            self.linked.tick(&mut self.app, ui.ctx());
+            UNSAVED.with(|u| u.set(self.launch.persists() && solidcraft_ui_egui::documents::any_dirty(&self.app)));
+            if self.launch.embed {
+                ui_kit::Container::new(ui.ctx(), ui_kit::Surface::Chrome).edge("embed_header", ui_kit::Edge::Top).show(ui, |ui| {
+                    if ui_kit::button(ui, solidcraft_ui_egui::i18n::tr("web.open_full"), ui_kit::Button::Normal).clicked()
+                        && let (Some(window), Some(url)) = (web_sys::window(), &self.full_url)
+                    {
+                        let _ = window.open_with_url_and_target_and_features(url, "_blank", "noopener");
+                    }
+                });
+            }
            self.app.ui(ui);
            let ctx = ui.ctx().clone();
-            self.file_panel(&ctx);
-            self.recovery_prompt(&ctx);
+            if self.launch.persists() {
+                self.file_panel(&ctx);
+                self.recovery_prompt(&ctx);
+            }
            self.watch_text_for_font(&ctx);
        }
+        fn persist_egui_memory(&self) -> bool {
+            self.launch.persists()
+        }
        fn save(&mut self, storage: &mut dyn eframe::Storage) {
+            if !self.launch.persists() {
+                return;
+            }
            // Persist the user's own language, not a session-only English fallback.
            let saved = self.font.persisted_language(&self.app.preferences.language).to_owned();
            let live = std::mem::replace(&mut self.app.preferences.language, saved);
@@ -557,15 +683,15 @@ mod web {

    /// Render with WebGL2: asked for now (`?webgl`, remembered) or before (until `?webgpu`).
    fn webgl() -> bool {
-        let storage = web_sys::window().and_then(|w| w.local_storage().ok().flatten());
+        let storage = crate::Launch::parse(&query()).persists().then(|| web_sys::window().and_then(|w| w.local_storage().ok().flatten())).flatten();
        let q = query();
-        if q.contains("webgl") {
+        if crate::query_flag(&q, "webgl") {
            if let Some(s) = &storage {
                let _ = s.set_item(WEBGL_KEY, "1");
            }
            return true;
        }
-        if q.contains("webgpu") {
+        if crate::query_flag(&q, "webgpu") {
            if let Some(s) = &storage {
                let _ = s.remove_item(WEBGL_KEY);
            }
@@ -591,7 +717,10 @@ mod web {
        eframe::WebLogger::init(log::LevelFilter::Info).ok();
        wasm_bindgen_futures::spawn_local(async {
            let Some(window) = web_sys::window() else { return };
-            ask_before_unload(&window);
+            let launch = crate::Launch::parse(&query());
+            if launch.persists() {
+                ask_before_unload(&window);
+            }
            leave_tab_switching_to_browser(&window);
            let Some(document) = window.document() else { return };
            let Some(canvas) = document.get_element_by_id(CANVAS_ID).and_then(|e| e.dyn_into::<web_sys::HtmlCanvasElement>().ok()) else {
@@ -611,19 +740,24 @@ mod web {
                    Box::new(move |cc| {
                        solidcraft_ui_egui::fonts::setup_fonts(&cc.egui_ctx);
                        let files = Rc::new(Files::default());
-                        files::start(&files);
+                        if launch.persists() {
+                            files::start(&files);
+                        }
                        let (panel, opener, saver, shown) = (files.clone(), files.clone(), files.clone(), files.clone());
                        let (restorable, restorer) = (files.clone(), files.clone());
-                        let services = Services {
+                        let services = if launch.embed { Services::default() } else { Services {
                            // Open shows the browser's open dialog for a design where it has one
-                            // (the file keeps its handle, so Save writes back to it); otherwise,
-                            // and for inserting STEP or meshes, the browser's files window.
-                            pick_open: Some(Box::new(move |exts: &[&str]| {
-                                if disk::handles_open(exts) {
-                                    return Box::pin(disk::pick_open(&opener));
+                            // (the file keeps its handle, so Save writes back to it), else the
+                            // browser's files window. A command that reads another kind of file
+                            // (Insert DXF or SVG, an image, a mesh, settings) gets a file dialog
+                            // offering that kind, and runs on the picked file.
+                            pick_open: Some(Box::new(move |exts: &[&str]| match disk::open_route(disk::supported(), exts) {
+                                disk::OpenRoute::Disk => Box::pin(disk::pick_open(&opener)),
+                                disk::OpenRoute::Upload => Box::pin(files::pick_upload(&opener, exts)),
+                                disk::OpenRoute::Panel => {
+                                    panel.panel.set(true);
+                                    Box::pin(std::future::ready(None))
                                }
-                                panel.panel.set(true);
-                                Box::pin(std::future::ready(None))
                            })),
                            // A design is saved to a file the user picks, or kept in the browser
                            // where the browser can't pick one; everything else is downloaded.
@@ -645,29 +779,31 @@ mod web {
                            })),
                            restore_file: Some(Box::new(move |path: &str| disk::restore(&restorer, path))),
                            download_design: Some(Box::new(files::download)),
+                            easyprint_upload: Some(std::sync::Arc::new(crate::easyprint::upload)),
                            browser_files: Some(Box::new(move || shown.panel.set(true))),
                            install_app: Some(crate::install::service(&cc.egui_ctx)),
                            ..Default::default()
-                        };
+                        }};
                        // Thumbnails of saves and start-page cards.
                        solidcraft_ui_egui::gpu::install_cpu_picture_renderer();
                        let (sender, receiver) = std::sync::mpsc::channel();
                        let mut app = SolveApp::new(Session::default(), services).with_control(receiver);
-                        if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
+                        app.embedded = launch.embed;
+                        if launch.persists() && let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))) {
                            app.load_prefs(&p);
                        }
                        if let Some(rs) = &cc.wgpu_render_state {
                            // eframe's web painter has no stencil buffer.
                            app.set_wgpu(rs, DEPTH_BITS, 0, 1);
                        }
-                        if query().contains("sample") {
+                        if launch.open.is_none() && crate::query_flag(&query(), "sample") {
                            if let Err(e) = app.session.run_script(&solidcraft_engine::sample::script()) {
                                app.set_status(format!("sample: {e}"), true);
                            }
                            app.session.doc_mut().name = "Sample Plate".into();
                            app.session.mark_saved();
                        }
-                        if !query().contains("sample") {
+                        if launch.open.is_none() && !crate::query_flag(&query(), "sample") {
                            // The empty design takes Units of new designs (#1205). The sample
                            // part is built in millimetres and is left that way.
                            solidcraft_ui_egui::prefs::apply_new_design(&mut app);
@@ -676,8 +812,13 @@ mod web {
                        }
                        let api = Api::install(sender, cc.egui_ctx.clone()).map_err(|e| format!("SolidCraft browser API: {e:?}"))?;
                        let font_language = app.preferences.language.clone();
+                        let linked = crate::linked::Download::start(launch.open.as_deref(), &cc.egui_ctx);
+                        let full_url = window.location().href().ok().and_then(|value| url::Url::parse(&value).ok()).map(|url| launch.full_app_url(url));
                        Ok(Box::new(Shell {
                            app,
+                            launch,
+                            linked,
+                            full_url,
                            api,
                            files,
                            autosaved_at: f64::NEG_INFINITY,
@@ -721,6 +862,90 @@ fn main() {
 mod tests {
    use super::*;

+    #[test]
+    fn link_query_decodes_once_and_embed_disables_persistence() {
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "webgl"));
+        assert!(!query_flag("?open=https://example.org/webgl?sample", "sample"));
+        assert!(query_flag("?embed&webgl", "webgl"));
+        let launch = Launch::parse("?embed&open=https%3A%2F%2Fexample.org%2Farm.solidcraft%3Fx%3Da%2520b%26y%3D1");
+        assert_eq!(launch.open.as_deref(), Some("https://example.org/arm.solidcraft?x=a%20b&y=1"));
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        assert!(!Launch::parse("?embed").embed);
+        assert!(!Launch::parse("?other=embed&reopen=https://example.org").embed);
+        assert!(Launch::parse("?open=https://example.org/a").persists());
+        assert_eq!(Launch::parse("?open=first&open=second").open.as_deref(), Some("first"));
+        let launch = Launch::parse("?embed&open=/dutchman/jobs/abc/part.solidcraft%3Fx%3Da%2520b");
+        assert!(launch.embed);
+        assert!(!launch.persists());
+        let page = url::Url::parse("http://solidcraft.io/?embed#view").expect("synthetic page");
+        let full = url::Url::parse(&launch.full_app_url(page)).expect("full app URL");
+        let reopened = Launch::parse(full.query().unwrap_or_default());
+        assert_eq!(reopened.open, launch.open);
+        assert_eq!(reopened.open.as_deref(), Some("/dutchman/jobs/abc/part.solidcraft?x=a%20b"));
+        assert!(!reopened.embed);
+        assert!(reopened.persists());
+        assert!(full.fragment().is_none());
+    }
+
+    #[test]
+    fn design_links_refuse_hostile_schemes_credentials_and_sizes() {
+        assert!(design_url("https://example.org/arm.solidcraft?download=1", "http://solidcraft.io").is_ok());
+        for value in [
+            "http://example.org/a",
+            "data:application/json,{}",
+            "blob:https://example.org/a",
+            "javascript:alert(1)",
+            "https://user:secret@example.org/a",
+            "//evil.example/x",
+            "/../x",
+            "/%2e%2e/x",
+            "/a/%2E./x",
+            "/a%2f..%2fx",
+            "/a\\x",
+            "/a%5cx",
+            "/a\nx",
+            "/a%00x",
+            "/a%7fx",
+            "/a%C2%85x",
+            "/a%3f/../x",
+            "/a/..#view",
+            "/a/..?download=1",
+            "https://solidcraft.io/a/../x",
+            "http://user:secret@solidcraft.io/x",
+            "http://solidcraft.io.evil.example/x",
+            "http://solidcraft.io:8080/x",
+            "relative.solidcraft",
+            "",
+        ] {
+            assert!(design_url(value, "http://solidcraft.io").is_err(), "{value}");
+        }
+        assert!(design_url(&format!("https://example.org/{}", "x".repeat(16_384)), "http://solidcraft.io").is_err());
+        assert!(design_url("http://redirect.example.org/a", "http://solidcraft.io").is_err());
+
+        let cap = solidcraft_engine::io::MAX_DESIGN_BYTES;
+        assert!(check_download_size(0, cap as u64).is_ok());
+        assert!(check_download_size(0, cap as u64 + 1).is_err());
+        assert!(check_download_size(cap - 2, 2).is_ok());
+        assert!(check_download_size(cap - 2, 3).is_err());
+        assert!(check_download_size(0, u64::MAX).is_err());
+        assert!(check_download_size(cap, 1).is_err());
+        assert!(check_download_size(usize::MAX, 0).is_err());
+    }
+
+    #[test]
+    fn design_links_allow_same_origin_paths_and_redirects() {
+        for origin in ["http://solidcraft.io", "https://solidcraft.io", "http://solidcraft.io:8080"] {
+            assert_eq!(design_url("/a/b.solidcraft", origin).map(|url| url.to_string()), Ok(format!("{origin}/a/b.solidcraft")));
+            assert!(design_url(&format!("{origin}/x"), origin).is_ok());
+            // Final response URLs follow the same origin and scheme rules as the request.
+            assert!(design_url("https://docs.solidcraft.io/x", origin).is_ok());
+            assert!(design_url("http://other/x", origin).is_err());
+        }
+        assert!(design_url("http://solidcraft.io/x", "https://solidcraft.io").is_err());
+        assert!(design_url("http://SOLIDCRAFT.io:80/x", "http://solidcraft.io").is_ok());
+    }
+
    #[test]
    fn only_ctrl_tab_is_left_to_the_browser() {
        // Ctrl+Tab and Ctrl+Shift+Tab (the event's key is "Tab" either way) switch browser tabs.
@@ -13,8 +13,9 @@ bundled-render-library = ["solidcraft-engine/bundled-render-library"]
 raytrace-cpu = ["solidcraft-engine/raytrace-cpu"]

 # The workspace lints, except unsafe_code: denied, not forbidden, so that src/open_documents.rs
-# (macOS file-open events), src/native_crash.rs (Windows exception filter) and src/native_frame.rs
-# (Windows resize border, taskbar icon) can allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
+# (macOS file-open events), src/native_crash.rs (Windows exception filter), src/native_crash_macos.rs
+# (macOS crash signal handler) and src/native_frame.rs (Windows resize border, taskbar icon) can
+# allow it: none has a safe API. Keep the rest in sync with [workspace.lints].
 [lints.rust]
 unsafe_code = "deny"

@@ -31,6 +32,7 @@ solidcraft-ui-egui = { workspace = true }
 solidcraft-space-mouse = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links"] }
 egui = { workspace = true }
+serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
@@ -88,6 +90,9 @@ objc2 = "0.6"
 objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder", "NSWindow"] }
 objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSProcessInfo", "NSString", "NSURL"] }
 block2 = "0.6"
+# Native crash capture (src/native_crash_macos.rs): the signal handler, the faulting module
+# (already in the tree through many crates).
+libc = "0.2"

 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 winit = { version = "0.30", default-features = false, features = ["x11"] }
@@ -13,11 +13,15 @@ use solidcraft_engine::MAX_LINE;
 use solidcraft_engine::control_auth;
 use solidcraft_engine::control_pending;
 use solidcraft_ui_egui::ControlRequest;
+use solidcraft_ui_egui::control::{DESIGN_WATCH, DesignWatch, Subscriber};

 /// Connections served at once, so a flood must not be able to spawn threads without end.
 const MAX_CONNECTIONS: usize = 16;
 /// Lines that are not JSON before the connection is closed, so garbage cannot loop forever.
 const MAX_BAD_LINES: usize = 8;
+/// How long a subscribed connection waits after a `design.changed` line before the next: what
+/// changes meanwhile (a parameter dragged) goes out as one line, the latest (#6985).
+const EVENT_GAP: Duration = Duration::from_millis(100);

 static OPEN: AtomicUsize = AtomicUsize::new(0);
 /// The token files this launch wrote (its control port, the agent chat's endpoint), removed
@@ -127,7 +131,7 @@ fn listen_on_listener(listener: TcpListener, token: String, tx: Sender<ControlRe
            if OPEN.fetch_add(1, Ordering::Relaxed) >= MAX_CONNECTIONS {
                OPEN.fetch_sub(1, Ordering::Relaxed);
                let mut refused = stream;
-                let _ = writeln!(refused, "{}", json!({"ok": false, "error": "too many connections"}));
+                let _ = send(&mut refused, &json!({"ok": false, "error": "too many connections"}));
                continue;
            }
            let tx = tx.clone();
@@ -174,6 +178,44 @@ fn read_line(r: &mut impl BufRead, max: usize) -> std::io::Result<Option<Vec<u8>
    }
 }

+/// A reply line, written to the socket at once. `writeln!` with a JSON value hands the socket each
+/// of its pieces apart, a system call for every string, number and comma: half a second for a
+/// design's component tree when it has thousands of components.
+fn send(out: &mut impl Write, reply: &Value) -> std::io::Result<()> {
+    let mut line = serde_json::to_vec(reply).map_err(std::io::Error::other)?;
+    line.push(b'\n');
+    out.write_all(&line)
+}
+
+/// The `"token"` of a request line that is a JSON object, read without building the rest of it.
+/// Until a connection shows the token, a line costs only its own bytes: parsed whole, a 16 MiB
+/// line of `[0,0,…]` is hundreds of MB, and 16 such connections could exhaust memory before any
+/// token was checked.
+fn token_of(line: &str) -> Option<String> {
+    struct Token;
+    impl<'de> serde::de::Visitor<'de> for Token {
+        type Value = Option<String>;
+        fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+            f.write_str("a request object")
+        }
+        fn visit_map<A: serde::de::MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+            let mut token = None;
+            while let Some(key) = map.next_key::<String>()? {
+                if key == "token" {
+                    token = Some(map.next_value::<String>()?);
+                } else {
+                    map.next_value::<serde::de::IgnoredAny>()?;
+                }
+            }
+            Ok(token)
+        }
+    }
+    let mut de = serde_json::Deserializer::from_str(line);
+    let token = serde::Deserializer::deserialize_map(&mut de, Token).ok()?;
+    de.end().ok()?;
+    token
+}
+
 /// The reply to a connection that didn't show the token; the connection is then closed.
 fn unauthorized() -> Value {
    json!({"ok": false, "error": "unauthorized: send the control token as \"token\" (see docs/control-protocol.md)"})
@@ -184,7 +226,7 @@ fn unauthorized() -> Value {
 /// the connection, and a reset can reach the client before it has read the refusal.
 fn refuse(out: &mut TcpStream, reader: &mut BufReader<TcpStream>) {
    use std::io::Read;
-    let _ = writeln!(out, "{}", unauthorized());
+    let _ = send(out, &unauthorized());
    let _ = out.shutdown(std::net::Shutdown::Write);
    let _ = reader.get_ref().set_read_timeout(Some(Duration::from_millis(500)));
    let _ = std::io::copy(&mut reader.by_ref().take(64 * 1024), &mut std::io::sink());
@@ -356,10 +398,95 @@ fn busy_message(p: &Pending, method: &str) -> String {
    )
 }

-fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
-    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING);
+/// A subscribed connection's socket, for its replies and its events: each line is written whole
+/// and alone, so an event never lands inside a reply (#6985).
+struct Lines {
+    socket: TcpStream,
+    turn: Mutex<()>,
 }

+impl Lines {
+    fn send(&self, line: &Value) -> std::io::Result<()> {
+        let _turn = self.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        send(&mut &self.socket, line)
+    }
+}
+
+/// A connection's `control.subscribe` (#6985): its `design.changed` lines, sent from a thread of
+/// their own until the connection ends.
+struct Subscription {
+    lines: Arc<Lines>,
+    stop: Arc<AtomicBool>,
+}
+
+impl Subscription {
+    /// Write `reply`, the window's answer to `control.subscribe` naming the design `seen`, on
+    /// `out`, then send `design`'s changes after it: the reply goes out before any event. `None`,
+    /// with nothing written, when no thread or socket was left for the events.
+    fn start(
+        design: &'static DesignWatch,
+        counted: Subscriber,
+        out: &TcpStream,
+        seen: (String, u64),
+        reply: &Value,
+    ) -> Option<(Self, std::io::Result<()>)> {
+        let lines = Arc::new(Lines { socket: out.try_clone().ok()?, turn: Mutex::new(()) });
+        let stop = Arc::new(AtomicBool::new(false));
+        let first = lines.turn.lock().unwrap_or_else(PoisonError::into_inner);
+        let (l, s) = (lines.clone(), stop.clone());
+        // The connection's seat on the watch rides the events thread: it leaves when the thread
+        // does, so the next failed write to a closed client retires it even while the connection's
+        // own thread is slow to see the end of the stream (#7226).
+        std::thread::Builder::new().stack_size(64 * 1024).spawn(move || send_events(design, &l, &s, seen, counted)).ok()?;
+        let sent = send(&mut &lines.socket, reply);
+        drop(first);
+        Some((Subscription { lines, stop }, sent))
+    }
+}
+
+/// The design a `control.subscribe` reply names.
+fn design_of(reply: &Value) -> Option<(String, u64)> {
+    let result = reply.get("result")?;
+    Some((result.get("document_id")?.as_str()?.to_string(), result.get("revision")?.as_u64()?))
+}
+
+impl Drop for Subscription {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+        // The socket closes now, not when the thread next looks; a line blocked on a client that
+        // stopped reading ends too.
+        let _ = self.lines.socket.shutdown(std::net::Shutdown::Both);
+    }
+}
+
+/// The `design.changed` lines of a subscribed connection, each time the design differs from the
+/// last one it was told of (`seen`), until `stop`. Owns the connection's seat on the watch
+/// (`counted`), so the seat leaves exactly when this thread does: on `stop`, or on the first
+/// write a closed client refuses (#7226).
+fn send_events(design: &DesignWatch, lines: &Lines, stop: &AtomicBool, mut seen: (String, u64), _counted: Subscriber) {
+    while !stop.load(Ordering::Relaxed) {
+        let Some(now) = design.wait(&seen, stop, Duration::from_secs(1)).filter(|now| *now != seen) else { continue };
+        if lines.send(&json!({"event": "design.changed", "params": {"document_id": now.0, "revision": now.1}})).is_err() {
+            break;
+        }
+        seen = now;
+        std::thread::sleep(EVENT_GAP);
+    }
+}
+
+/// Write `reply` on the connection: through its subscription once it has one.
+fn answer(out: &mut TcpStream, events: Option<&Subscription>, reply: &Value) -> std::io::Result<()> {
+    match events {
+        Some(e) => e.lines.send(reply),
+        None => send(out, reply),
+    }
+}
+
+fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, patient: bool) {
+    serve_with(stream, token, tx, ctx, patient, WAITS, &RUNNING, &DESIGN_WATCH);
+}
+
+#[allow(clippy::too_many_arguments)]
 fn serve_with(
    stream: TcpStream,
    token: &str,
@@ -368,6 +495,7 @@ fn serve_with(
    patient: bool,
    waits: Waits,
    running: &'static Running,
+    design: &'static DesignWatch,
 ) {
    let connection = running.connections.fetch_add(1, Ordering::Relaxed) + 1;
    let Ok(read) = stream.try_clone() else { return };
@@ -376,30 +504,33 @@ fn serve_with(
    let mut bad = 0usize;
    let mut authenticated = false;
    let mut pending: Option<Pending> = None;
+    let mut events: Option<Subscription> = None;
    loop {
+        // A first `control.subscribe` on its way to the window (#6985).
+        let mut joining = None;
        let line = match read_line(&mut reader, MAX_LINE) {
            Ok(Some(l)) => String::from_utf8_lossy(&l).into_owned(),
            Ok(None) => break,
            Err(e) => {
-                let _ = writeln!(out, "{}", json!({"ok": false, "error": e.to_string()}));
+                let _ = answer(&mut out, events.as_ref(), &json!({"ok": false, "error": e.to_string()}));
                break;
            }
        };
        if line.trim().is_empty() {
            continue;
        }
+        // The first request must carry the token; later ones on the same connection may.
+        if !authenticated {
+            match token_of(&line) {
+                Some(t) if control_auth::tokens_match(&t, token) => authenticated = true,
+                _ => {
+                    refuse(&mut out, &mut reader);
+                    break;
+                }
+            }
+        }
        let reply = match serde_json::from_str::<Value>(&line) {
            Ok(msg) => {
-                // The first request must carry the token; later ones on the same connection may.
-                if !authenticated {
-                    match msg.get("token").and_then(Value::as_str) {
-                        Some(t) if control_auth::tokens_match(t, token) => authenticated = true,
-                        _ => {
-                            refuse(&mut out, &mut reader);
-                            break;
-                        }
-                    }
-                }
                let id = msg.get("id").cloned().unwrap_or(Value::Null);
                let method = msg.get("method").and_then(Value::as_str).unwrap_or("").to_string();
                let params = msg.get("params").cloned().unwrap_or(json!({}));
@@ -425,6 +556,14 @@ fn serve_with(
                } else if let Some(p) = pending.as_ref().filter(|_| late.is_none()) {
                    // Nothing more is queued behind it, to run unseen when it ends.
                    json!({"ok": false, "busy": true, "error": busy_message(p, &method)})
+                } else if method == "control.subscribe" && events.is_some() {
+                    if late.is_some() {
+                        // As below: finished, and the client moved on without asking.
+                        pending = None;
+                    }
+                    // Its events already say how the design moves; a second answer could only
+                    // arrive behind a newer one.
+                    json!({"ok": false, "error": "already subscribed: this connection is sent design.changed lines; ask document.revision for the design now"})
                } else {
                    if late.is_some() {
                        // Finished, and the client moved on without asking: it is dropped.
@@ -434,6 +573,9 @@ fn serve_with(
                    let wait = if patient || method == "engine.batch" { waits.long } else { waits.short };
                    let what = control_pending::describe(&method, &params);
                    let effect = control_pending::effect(&method, &params);
+                    // Counted before the window answers, so it publishes every change from its
+                    // answer on.
+                    joining = (method == "control.subscribe").then(|| design.join());
                    let (req, rrx) = ControlRequest::new(method.clone(), params);
                    let ticket = running.add(connection, &id, &req);
                    if tx.send(req).is_err() {
@@ -454,16 +596,25 @@ fn serve_with(
                }
                r
            }
-            Err(_) if !authenticated => {
-                refuse(&mut out, &mut reader);
-                break;
-            }
            Err(e) => {
                bad += 1;
                json!({"ok": false, "error": format!("bad JSON: {e}")})
            }
        };
-        if writeln!(out, "{reply}").is_err() {
+        // Subscribed once the window named the design (not when it refused or timed out).
+        let sent = match joining.and_then(|counted| design_of(&reply).map(|seen| (counted, seen))) {
+            Some((counted, seen)) => match Subscription::start(design, counted, &out, seen, &reply) {
+                Some((subscription, sent)) => {
+                    events = Some(subscription);
+                    sent
+                }
+                None => {
+                    send(&mut out, &json!({"id": reply.get("id"), "ok": false, "error": "not subscribed: no thread or socket left for the events"}))
+                }
+            },
+            None => answer(&mut out, events.as_ref(), &reply),
+        };
+        if sent.is_err() {
            break;
        }
        if bad >= MAX_BAD_LINES {
@@ -503,7 +654,7 @@ mod tests {
        static RUNNING: Running = Running::new();
        std::thread::spawn(move || {
            if let Some(stream) = listener.incoming().flatten().next() {
-                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING);
+                serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH);
            }
        });
        let s = TcpStream::connect(addr).unwrap();
@@ -569,7 +720,7 @@ mod tests {
        std::thread::spawn(move || {
            for stream in listener.incoming().flatten() {
                let tx = tx.clone();
-                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING));
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, waits, &RUNNING, &DESIGN_WATCH));
            }
        });
        let open = || {
@@ -639,6 +790,101 @@ mod tests {
        assert_eq!((&r["result"]["pending"], &r["result"]["done"]), (&json!(7), &json!(true)), "{r}");
    }

+    /// #6985: a connection that sends `control.subscribe` gets the design in the reply, then a
+    /// `design.changed` line each time the window publishes another: never before the reply,
+    /// none for the same design, the latest after a burst, each line whole between its replies.
+    /// A second subscribe is refused without reaching the window. A connection that did not
+    /// subscribe gets no events, and one that closed is no longer counted.
+    #[test]
+    fn subscribed_connections_are_told_of_design_changes() {
+        static RUNNING: Running = Running::new();
+        static WATCH: DesignWatch = DesignWatch::new();
+        let token = "0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        // The window: it answers `control.subscribe` as the app does, publishing the design first;
+        // then the design changes at once, before the reply may have been written.
+        std::thread::spawn(move || {
+            for req in rx {
+                if req.method == "control.subscribe" {
+                    WATCH.publish("d-1", 3);
+                    let _ = req.reply.send(json!({"ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+                    WATCH.publish("d-1", 4);
+                } else {
+                    let _ = req.reply.send(json!({"ok": true, "result": req.method}));
+                }
+            }
+        });
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let tx = tx.clone();
+                std::thread::spawn(move || serve_with(stream, token, tx, egui::Context::default(), false, WAITS, &RUNNING, &WATCH));
+            }
+        });
+        let open = || {
+            let s = TcpStream::connect(addr).unwrap();
+            s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+            (s.try_clone().unwrap(), BufReader::new(s))
+        };
+        let next = |lines: &mut BufReader<TcpStream>| -> Value {
+            let mut l = String::new();
+            lines.read_line(&mut l).unwrap();
+            serde_json::from_str(&l).unwrap()
+        };
+        let changed = |id: &str, revision: u64| json!({"event": "design.changed", "params": {"document_id": id, "revision": revision}});
+
+        let (mut quiet_out, mut quiet) = open();
+        writeln!(quiet_out, "{}", json!({"id": 1, "method": "ui.view", "token": token})).unwrap();
+        assert_eq!(next(&mut quiet)["id"], 1);
+
+        let (mut out, mut lines) = open();
+        writeln!(out, "{}", json!({"id": 1, "method": "control.subscribe", "token": token})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 1, "ok": true, "result": {"document_id": "d-1", "revision": 3}}));
+        assert_eq!(next(&mut lines), changed("d-1", 4), "the change after the window's answer comes after the reply");
+        assert!(WATCH.subscribed());
+        // The design it was told of is no news; another revision is.
+        WATCH.publish("d-1", 4);
+        WATCH.publish("d-1", 5);
+        assert_eq!(next(&mut lines), changed("d-1", 5));
+        // A burst ends with its latest.
+        for revision in 6..=10 {
+            WATCH.publish("d-1", revision);
+        }
+        let mut last = 5;
+        while last < 10 {
+            let e = next(&mut lines);
+            let revision = e["params"]["revision"].as_u64().unwrap();
+            assert!(e["event"] == "design.changed" && revision > last, "{e} after {last}");
+            last = revision;
+        }
+        // Another tab: another id, whatever its revision.
+        WATCH.publish("d-2", 2);
+        assert_eq!(next(&mut lines), changed("d-2", 2));
+        // Subscribed already: refused here (the window would have published d-1 again).
+        writeln!(out, "{}", json!({"id": 2, "method": "control.subscribe"})).unwrap();
+        let r = next(&mut lines);
+        assert!(r["id"] == 2 && r["ok"] == false && r["error"].as_str().is_some_and(|e| e.starts_with("already subscribed")), "{r}");
+        // Replies still come, whole, and nothing else was sent meanwhile.
+        writeln!(out, "{}", json!({"id": 3, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut lines), json!({"id": 3, "ok": true, "result": "ui.view"}));
+        writeln!(quiet_out, "{}", json!({"id": 2, "method": "ui.view"})).unwrap();
+        assert_eq!(next(&mut quiet), json!({"id": 2, "ok": true, "result": "ui.view"}), "no events without subscribing");
+        // Closed, it is no longer counted. Each publish asks the events thread for one more line,
+        // and its write to the closed connection is what retires the seat; that keeps the wait off
+        // the connection's own thread, which anything else this process is doing may hold up past
+        // the deadline (#7226).
+        drop((out, lines));
+        let mut revision = 11;
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while WATCH.subscribed() && Instant::now() < deadline {
+            WATCH.publish("d-1", revision);
+            revision += 1;
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        assert!(!WATCH.subscribed());
+    }
+
    /// A timed-out request that only reads is not said to "still apply", nor is one that only
    /// writes a file (an export, #1989); a change is, by name.
    #[test]
@@ -658,6 +904,19 @@ mod tests {
        assert!(render.contains("will still write the file"), "{render}");
    }

+    /// The token is read from a request object without building the rest of it: other fields,
+    /// however large or nested, are only skipped. Anything but an object with a string token is
+    /// no token.
+    #[test]
+    fn token_is_read_without_parsing_the_request() {
+        assert_eq!(token_of(r#"{"id":1,"token":"abc","params":{"a":[1,[2,{"b":null}]]}}"#).as_deref(), Some("abc"));
+        let flood = format!(r#"{{"params":[{}0],"token":"t"}}"#, "0,".repeat(1 << 20));
+        assert_eq!(token_of(&flood).as_deref(), Some("t"));
+        for no in [r#"["abc"]"#, r#"{"token":5}"#, r#"{"token":"a"} x"#, r#"{"id":1}"#, "GET / HTTP/1.1", r#""token""#] {
+            assert_eq!(token_of(no), None, "{no}");
+        }
+    }
+
    /// #205: a connection runs nothing until a request carries the launch's token; a wrong or
    /// missing token, or garbage, is refused and the connection closed. Once shown, the token
    /// need not be repeated on that connection.
@@ -750,4 +1009,31 @@ mod tests {
        let mut r = BufReader::with_capacity(64, text.as_slice());
        assert!(read_line(&mut r, 1000).is_err());
    }
+
+    /// A large reply reaches the socket in one write, not one per JSON piece (a component tree of
+    /// thousands of components took half a second to send), and reads back as it was.
+    #[test]
+    fn a_large_reply_is_written_at_once() {
+        struct Counted {
+            writes: usize,
+            bytes: Vec<u8>,
+        }
+        impl Write for Counted {
+            fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+                self.writes += 1;
+                self.bytes.extend_from_slice(buf);
+                Ok(buf.len())
+            }
+            fn flush(&mut self) -> std::io::Result<()> {
+                Ok(())
+            }
+        }
+        let components: Vec<Value> = (0..2000).map(|i| json!({"id": i, "name": format!("Part {i}"), "bodies": ["a", "b"], "parent": 0})).collect();
+        let reply = json!({"ok": true, "id": 7, "result": {"components": components}});
+        let mut out = Counted { writes: 0, bytes: Vec::new() };
+        send(&mut out, &reply).unwrap();
+        assert_eq!(out.writes, 1);
+        assert_eq!(out.bytes.last(), Some(&b'\n'));
+        assert_eq!(serde_json::from_slice::<Value>(&out.bytes).unwrap(), reply);
+    }
 }
@@ -1,6 +1,6 @@
 //! SolidCraft desktop app.
 //!
-//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]`
+//! Usage: `solidcraft [--control <port>] [--sample] [--crash-log] [--safe-mode] [design.sc | part.step]`
 //!
 //! `--safe-mode` (or `SOLIDCRAFT_SAFE_MODE=1`) starts with default settings, no recovery offer and
 //! the software renderer; see `startup` and docs/book/src/guide/troubleshooting.md.
@@ -24,10 +24,13 @@ mod control_server;
 mod device_lost;
 #[cfg(target_os = "windows")]
 mod native_crash;
+#[cfg(target_os = "macos")]
+mod native_crash_macos;
 #[cfg(target_os = "windows")]
 mod native_frame;
 #[cfg(target_os = "macos")]
 mod native_menu;
+mod nav_bridge;
 #[cfg(target_os = "macos")]
 mod open_documents;
 #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
@@ -87,6 +90,10 @@ struct App {
    space_mouse: space_mouse::SpaceMouse,
    #[cfg(target_os = "macos")]
    native_menu: Option<native_menu::NativeMenu>,
+    /// A device's own app moving the view (Preferences › Navigation, off by default).
+    nav_bridge: nav_bridge::NavBridge,
+    /// Where the next file dialog opens: it follows the open design (#7756).
+    dialog_folder: DialogFolder,
 }

 impl eframe::App for App {
@@ -117,6 +124,7 @@ impl eframe::App for App {
                // Automation runs (a control port was asked for) leave the user's AI apps alone.
                if !self.take_focus_unwanted {
                    solidcraft_ui_egui::ai_connect::begin(&mut self.solve);
+                    solidcraft_ui_egui::agent_chat::begin(&mut self.solve);
                }
                if let Some(dir) = self.starting.take() {
                    startup::started(&dir);
@@ -141,10 +149,13 @@ impl eframe::App for App {
            menu.tick(&mut self.solve, ctx);
        }
        self.solve.logic(ctx);
+        self.dialog_folder.design(self.solve.session.path.as_deref());
        #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
        if !self.solve.file_picker_busy() {
            self.space_mouse.tick(&mut self.solve, ctx);
        }
+        // Every frame, so switching the bridge off reaches the reader while a picker is open too.
+        self.nav_bridge.tick(&mut self.solve, ctx);
        if self.solve.quit_requested {
            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
        }
@@ -182,6 +193,10 @@ impl eframe::App for App {
        }
        solidcraft_ui_egui::recovery_ui::close(&mut self.solve);
        solidcraft_ui_egui::open_elsewhere::close(&mut self.solve);
+        // Before a restart below starts the next instance, which would otherwise get nothing from
+        // the 3D mouse driver (`solidcraft_3dx_client::stop`).
+        #[cfg(target_os = "macos")]
+        solidcraft_3dx_client::stop();
        solidcraft_engine::crash::end_session();
        if let Some(lost_at) = self.gpu.as_ref().and_then(|g| g.lost_at) {
            device_lost::restart(self.gpu.as_ref().is_some_and(|g| g.restart_on_software), lost_at);
@@ -229,6 +244,60 @@ impl App {
    }
 }

+/// Where the next file dialog opens (#7756): the folder of the file last chosen in one, or of the
+/// design last opened or saved, whichever came last. Linux dialogs otherwise open in the home
+/// folder every time; macOS and Windows remember a folder of their own, which this agrees with.
+#[derive(Clone, Default)]
+struct DialogFolder(std::sync::Arc<std::sync::Mutex<DialogFolderState>>);
+
+#[derive(Default)]
+struct DialogFolderState {
+    folder: Option<std::path::PathBuf>,
+    /// The open design's path when last looked at, to notice another design opened or saved.
+    design: Option<String>,
+}
+
+impl DialogFolder {
+    /// A file was chosen in a dialog: the next one opens in its folder.
+    fn chosen(&self, file: &std::path::Path) {
+        if let (Some(folder), Ok(mut state)) = (file.parent().filter(|f| !f.as_os_str().is_empty()), self.0.lock()) {
+            state.folder = Some(folder.to_path_buf());
+        }
+    }
+
+    /// The open design's path, every frame: a design opened or saved somewhere else moves the
+    /// next dialog to its folder; the same design again leaves a folder chosen since alone.
+    fn design(&self, path: Option<&str>) {
+        let Ok(mut state) = self.0.lock() else { return };
+        if state.design.as_deref() == path {
+            return;
+        }
+        state.design = path.map(str::to_string);
+        if let Some(folder) = path.and_then(|p| std::path::Path::new(p).parent()).filter(|f| !f.as_os_str().is_empty()) {
+            state.folder = Some(folder.to_path_buf());
+        }
+    }
+
+    /// A dialog's answer as a path, its folder remembered for the next dialog.
+    fn answer(&self, picked: Option<rfd::FileHandle>) -> Option<String> {
+        let picked = picked?;
+        self.chosen(picked.path());
+        Some(picked.path().to_string_lossy().into_owned())
+    }
+
+    fn folder(&self) -> Option<std::path::PathBuf> {
+        self.0.lock().ok().and_then(|state| state.folder.clone())
+    }
+
+    /// The dialog, opening in the remembered folder when there is one.
+    fn start(&self, dialog: rfd::AsyncFileDialog) -> rfd::AsyncFileDialog {
+        match self.folder() {
+            Some(folder) => dialog.set_directory(folder),
+            None => dialog,
+        }
+    }
+}
+
 /// Linux file dialogs match patterns by case, so each extension goes in as lower and upper
 /// case, plus FreeCAD's own mixed casing.
 fn case_variants(exts: &[&str]) -> Vec<String> {
@@ -278,26 +347,30 @@ fn fullscreen_content_insets(raw: &mut egui::RawInput, title_height: f32, zoom:
    raw.safe_area_insets = Some(insets);
 }

-fn services(cc: &eframe::CreationContext<'_>) -> Services {
+fn services(cc: &eframe::CreationContext<'_>, folder: &DialogFolder) -> Services {
    let parent = rfd::AsyncFileDialog::new().set_parent(cc);
    let open_parent = parent.clone();
    let program_parent = parent.clone();
    let file_parent = parent.clone();
+    let (open_folder, file_folder, save_folder) = (folder.clone(), folder.clone(), folder.clone());
    Services {
        pick_open: Some(Box::new(move |first: &[&str]| {
            // The file type the command reads comes first, so the picker opens on it (#1801).
-            let mut dialog = open_parent.clone();
+            let mut dialog = open_folder.start(open_parent.clone());
            if !first.is_empty() {
                let label = first.iter().map(|e| e.to_uppercase()).collect::<Vec<_>>().join(", ");
                dialog = dialog.add_filter(label, &case_variants(first));
            }
            // The groups come from the format registry, so a new format joins this dialog by itself.
-            dialog = dialog.add_filter("Designs, CAD files and meshes", &case_variants(&io::formats::open_extensions(true)));
+            let mut everything = io::formats::open_extensions(true);
+            everything.extend(["dxf", "svg"]);
+            dialog = dialog.add_filter(solidcraft_ui_egui::i18n::tr("file.open.drawing_filter"), &case_variants(&everything));
            for (label, exts) in io::formats::import_filters(true) {
                dialog = dialog.add_filter(label, &case_variants(&exts));
            }
            let future = dialog.add_filter("All files", &["*"]).pick_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let folder = open_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
        // One kind of file (the agent chat's attachments): only the types it names, as given and in
        // lower and upper case (Linux dialogs match case; macOS allows just the listed types).
@@ -312,8 +385,9 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
            }
            let all: Vec<&str> = all.iter().map(String::as_str).collect();
            // Any other file attaches by reference, so the list is not the only choice.
-            let future = file_parent.clone().add_filter(label, &all).add_filter("All files", &["*"]).pick_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let future = file_folder.start(file_parent.clone()).add_filter(label, &all).add_filter("All files", &["*"]).pick_file();
+            let folder = file_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
        pick_program: Some(Box::new(move || {
            let dialog = program_parent.clone().set_title("Choose your slicer");
@@ -322,7 +396,7 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
        })),
        pick_save: Some(Box::new(move |name: &str, exts: &[&str]| {
-            let dialog = parent.clone().set_file_name(name);
+            let dialog = save_folder.start(parent.clone()).set_file_name(name);
            let dialog = if exts == [io::DESIGN_EXT, "json"] {
                if name.ends_with(".json") {
                    dialog.add_filter("Plain JSON design", &["json"]).add_filter("SolidCraft container", &[io::DESIGN_EXT])
@@ -333,8 +407,10 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
                dialog.add_filter("File", exts)
            };
            let future = dialog.save_file();
-            Box::pin(async move { future.await.map(|p| p.path().to_string_lossy().into_owned()) })
+            let folder = save_folder.clone();
+            Box::pin(async move { folder.answer(future.await) })
        })),
+        graphics_adapters: Vec::new(),
        graphics_path: graphics_path().map(|p| p.to_string_lossy().to_string()),
        window_system: window_system_now(),
        http_get: Some(std::sync::Arc::new(http_get)),
@@ -344,6 +420,7 @@ fn services(cc: &eframe::CreationContext<'_>) -> Services {
        can_restore: None,
        restore_file: None,
        download_design: None,
+        easyprint_upload: Some(std::sync::Arc::new(easyprint_upload)),
        browser_files: None,
        agent_http: Some(std::sync::Arc::new(agent_http)),
        secrets: Some(std::sync::Arc::new(Keychain)),
@@ -440,6 +517,24 @@ fn agent_http(r: &solidcraft_ui_egui::agent_chat::backend::HttpRequest) -> Resul
    Ok((status, body))
 }

+/// Open with EasyPrint: upload the model to Printables' import endpoint on a worker and answer on
+/// `done` with the address to open. Through [`agent_http`]: no redirects, a timeout, no cookies.
+fn easyprint_upload(name: &str, bytes: Vec<u8>, done: std::sync::mpsc::Sender<Result<String, String>>) {
+    use solidcraft_engine::easyprint;
+    let name = name.to_string();
+    std::thread::spawn(move || {
+        let (content_type, body) = easyprint::multipart(&name, &bytes);
+        let request = solidcraft_ui_egui::agent_chat::backend::HttpRequest {
+            method: "POST",
+            url: easyprint::IMPORT_URL.into(),
+            headers: vec![("Content-Type".into(), content_type), ("Accept".into(), "application/json".into())],
+            body: Some(body),
+            timeout_s: 180,
+        };
+        let _ = done.send(agent_http(&request).and_then(|(status, body)| easyprint::parse_import_response(status, &body)));
+    });
+}
+
 /// API keys in the system keychain (service "SolidCraft agent chat", one entry per agent).
 struct Keychain;

@@ -520,26 +615,26 @@ fn graphics_path() -> Option<std::path::PathBuf> {
 /// Compatibility shim (docs/compatibility.md): on the first launch after the rename, copy the
 /// settings of earlier releases into the new folder. They kept `graphics.json` (and, on Linux
 /// and macOS, the recovery folder) under the old product name, and eframe's `app.ron` under the
-/// window's old app id. In the Flatpak sandbox, releases before 0.8 kept everything under the
-/// old app id's `~/.var/app` folder; that copy comes first, as it is the newest. The old folders
+/// window's old app id. In the Flatpak sandbox, earlier releases kept everything under an
+/// old app id's `~/.var/app` folder; those copies come first, newest first. The old folders
 /// are never changed.
 fn adopt_legacy_settings() {
    let (Some(current), Some(legacy)) = (settings_dir().ok().flatten(), eframe::storage_dir("SolveCraft")) else { return };
    let legacy_eframe = eframe::storage_dir(solidcraft_engine::io::LEGACY_APP_ID);
-    let old_flatpak = solidcraft_engine::io::legacy_flatpak_path(&current);
-    if let Err(e) = adopt_settings(&current, old_flatpak.as_deref(), &legacy, legacy_eframe.as_deref()) {
+    let old_flatpak = solidcraft_engine::io::legacy_flatpak_paths(&current);
+    if let Err(e) = adopt_settings(&current, &old_flatpak, &legacy, legacy_eframe.as_deref()) {
        log::warn!("settings: could not copy the previous release's settings into {}: {e}", current.display());
    }
 }

 fn adopt_settings(
    current: &std::path::Path,
-    old_flatpak: Option<&std::path::Path>,
+    old_flatpak: &[std::path::PathBuf],
    legacy: &std::path::Path,
    legacy_eframe: Option<&std::path::Path>,
 ) -> std::io::Result<()> {
    let fresh = !current.exists();
-    if let Some(old) = old_flatpak {
+    for old in old_flatpak {
        solidcraft_engine::io::adopt_legacy_dir(current, old)?;
    }
    solidcraft_engine::io::adopt_legacy_dir(current, legacy)?;
@@ -575,13 +670,22 @@ fn scene_samples(backend: eframe::wgpu::Backend, samples: u32, supported: &[u32]
    }
 }

-/// Anti-aliasing samples from Preferences (4 when unset).
-fn msaa() -> u16 {
+/// Keep the default until the installed renderer's startup check proves a fallback is needed.
+fn scene_msaa_request(saved: Option<u16>) -> u16 {
+    saved.unwrap_or(MSAA)
+}
+
+/// Query the scene's colour/depth intersection, rather than the depthless window's counts.
+fn scene_sample_choices(depth_bits: u8, stencil_bits: u8, query: impl FnOnce(Option<eframe::wgpu::TextureFormat>) -> Vec<u32>) -> Vec<u32> {
+    query(eframe::egui_wgpu::depth_format_from_bits(depth_bits, stencil_bits))
+}
+
+/// An explicitly saved anti-aliasing choice, absent until Graphics changes it.
+fn msaa() -> Option<u16> {
    graphics()
        .and_then(|v| v.get("msaa").and_then(serde_json::Value::as_u64))
        .and_then(|m| u16::try_from(m).ok())
        .filter(|m| [1, 2, 4, 8].contains(m))
-        .unwrap_or(MSAA)
 }

 /// Windows and Linux: no OS title bar; the application bar is the title bar
@@ -621,6 +725,18 @@ fn app_viewport(custom_titlebar: bool) -> Result<egui::ViewportBuilder, eframe::
 /// The window's app id: it names the desktop entry, so it is the packages' reverse-DNS id.
 const APP_ID: &str = solidcraft_engine::io::APP_ID;

+/// Disconnects from the 3D mouse driver when dropped, as `main` returns or a panic unwinds out
+/// of it (`solidcraft_3dx_client::stop`).
+#[cfg(target_os = "macos")]
+struct DriverClient;
+
+#[cfg(target_os = "macos")]
+impl Drop for DriverClient {
+    fn drop(&mut self) {
+        solidcraft_3dx_client::stop();
+    }
+}
+
 fn main() -> eframe::Result {
    #[cfg(target_os = "macos")]
    objc2_foundation::NSProcessInfo::processInfo().setProcessName(objc2_foundation::ns_string!("SolidCraft"));
@@ -634,11 +750,14 @@ fn main() -> eframe::Result {
    let mut control_port: Option<u16> = solidcraft_engine::geom::env::var("CONTROL_PORT").and_then(|p| p.parse().ok());
    let mut files = Vec::new();
    let mut sample = false;
+    // `--theme-file PATH`: follow that theme file for this run without saving it (#7573).
+    let mut theme_file: Option<String> = None;
    let mut args = std::env::args().skip(1);
    while let Some(a) = args.next() {
        match a.as_str() {
            "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
            "--sample" => sample = true,
+            "--theme-file" => theme_file = args.next(),
            "--safe-mode" => safe_mode = true,
            "--version" | "-V" => {
                println!("solidcraft {}", env!("CARGO_PKG_VERSION"));
@@ -658,7 +777,9 @@ fn main() -> eframe::Result {
                return Ok(());
            }
            "--help" | "-h" => {
-                println!("usage: solidcraft [--control PORT] [--sample] [--crash-log] [--safe-mode] [design.solidcraft | part.step]");
+                println!(
+                    "usage: solidcraft [--control PORT] [--sample] [--theme-file THEME.json] [--crash-log] [--safe-mode] [design.sc | part.step]"
+                );
                return Ok(());
            }
            _ => files.push(a),
@@ -685,7 +806,13 @@ fn main() -> eframe::Result {
    if safe_mode {
        notes.push("Safe mode: default settings (yours are kept for the next normal start), no recovery offer, software rendering.".into());
    }
-    let samples = if safe_mode { MSAA } else { msaa() };
+    let fallback_note = std::env::var(startup::FALLBACK_NOTE_ENV).ok().map(|s| s.chars().take(4096).collect::<String>());
+    if let Some(note) = &fallback_note {
+        log::warn!("{note}");
+        eprintln!("SolidCraft: {note}");
+        notes.push(note.clone());
+    }
+    let saved_samples = if safe_mode { None } else { msaa() };
    let wgpu_options = wgpu_options(cpu_renderer, if safe_mode { None } else { backend_preference() }.as_deref());
    let depth_bits = if !safe_mode && startup::float_depth_everywhere(&wgpu_options) { FLOAT_DEPTH_BITS } else { DEPTH_BITS };
    // Crashes leave a report in the crash folder (solidcraft_engine::crash, docs/crash-reports.md).
@@ -699,10 +826,12 @@ fn main() -> eframe::Result {
            solidcraft_engine::crash::install(dir, build)
        })
        .unwrap_or_default();
-    // A crash in native code (a graphics driver) says where it happened: the exception and the
-    // module on Windows, and on every system the startup step the app was in.
+    // A crash in native code (a graphics driver) says where it happened: the exception or signal
+    // and the module on Windows and macOS, and on every system the startup step the app was in.
    #[cfg(target_os = "windows")]
    native_crash::install();
+    #[cfg(target_os = "macos")]
+    native_crash_macos::install();
    // Windows with only OpenGL to start: the system title bar instead of ours (#2063).
    let started = match &wgpu_options.wgpu_setup {
        eframe::egui_wgpu::WgpuSetup::CreateNew(setup) => setup.instance_descriptor.backends,
@@ -763,6 +892,10 @@ fn main() -> eframe::Result {
    let created = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
    let created_in_app = created.clone();
    let starting = settings.clone();
+    // A panic on the window's thread ends the app without `on_exit`; this disconnects from the
+    // 3D mouse driver then too.
+    #[cfg(target_os = "macos")]
+    let _driver_client = DriverClient;
    mark("run_native");
    let result = eframe::run_native(
        "SolidCraft",
@@ -774,7 +907,8 @@ fn main() -> eframe::Result {
            solidcraft_ui_egui::fonts::setup_bundled_fonts(&cc.egui_ctx);
            solidcraft_ui_egui::fonts::load_system_fonts_in_background(&cc.egui_ctx);
            mark("fonts");
-            let mut app = SolveApp::new(Session::default(), services(cc));
+            let dialog_folder = DialogFolder::default();
+            let mut app = SolveApp::new(Session::default(), services(cc, &dialog_folder));
            app.apply_off_thread = Some(solidcraft_ui_egui::dialogs::APPLY_AT_ONCE);
            app.custom_titlebar = custom_titlebar;
            #[cfg(target_os = "windows")]
@@ -793,28 +927,52 @@ fn main() -> eframe::Result {
            }
            app.integrated_titlebar = cfg!(target_os = "macos");
            app.cpu_meshing = safe_mode;
+            app.graphics_fallback = fallback_note.clone();
            if let Some(p) = cc.storage.and_then(|s| solidcraft_ui_egui::prefs::stored(|k| s.get_string(k))).filter(|_| !safe_mode) {
                app.load_prefs(&p);
            }
+            if let Some(path) = &theme_file
+                && let Err(e) = solidcraft_ui_egui::prefs::follow_theme_file_for_run(&mut app, path)
+            {
+                app.set_status(format!("--theme-file: {e}"), true);
+            }
            mark("app state and prefs");
            let gpu = cc.wgpu_render_state.as_ref().map(|rs| LostWatch {
                lost: rs.device_lost.clone(),
                restart_on_software: device_lost::restart_on_software(after_loss, cpu_renderer),
                lost_at: None,
            });
+            if !safe_mode {
+                app.preferences.graphics_adapter =
+                    graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string)).unwrap_or_default();
+            }
            if let Some(rs) = &cc.wgpu_render_state {
-                let scene_samples = scene_samples(rs.adapter.get_info().backend, u32::from(samples), &rs.msaa_supported);
+                app.services.graphics_adapters = rs
+                    .available_adapters
+                    .iter()
+                    .map(|adapter| {
+                        let info = adapter.get_info();
+                        (info.name.clone(), format!("{} ({:?}, {:?})", info.name, info.device_type, info.backend))
+                    })
+                    .collect();
+                let info = rs.adapter.get_info();
+                let samples = scene_msaa_request(saved_samples);
+                let supported = scene_sample_choices(depth_bits, STENCIL_BITS, |depth| {
+                    eframe::egui_wgpu::supported_msaa_samples(&rs.adapter, &rs.device, rs.target_format, depth)
+                });
+                let scene_samples = scene_samples(info.backend, u32::from(samples), &supported);
                eprintln!("SolidCraft graphics: {:?}, MSAA {scene_samples}x (requested {}x)", rs.adapter.get_info().backend, samples);
                solidcraft_engine::crash::phase("viewport pipelines (shader compile)");
-                app.set_wgpu_split(rs, depth_bits, STENCIL_BITS, scene_samples);
+                let scene_samples = app.set_wgpu_split(rs, depth_bits, STENCIL_BITS, scene_samples);
+                app.msaa_supported = supported;
+                app.preferences.msaa = u32::from(samples);
                solidcraft_ui_egui::gpu::install_picture_renderer(rs);
                // The graphics driver is loaded now; it may have put its own exception filter
                // in front of ours.
                #[cfg(target_os = "windows")]
                native_crash::reinstall();
-                // A saved anti-aliasing the device can't do: back to the default, with a notice.
+                // Reflect a confirmed probe fallback or an unsupported saved count in Graphics.
                solidcraft_ui_egui::prefs::check_msaa(&mut app, u32::from(samples));
-                let info = rs.adapter.get_info();
                solidcraft_engine::crash::set_environment(&format!(
                    "Renderer: {:?} {} ({}), MSAA {scene_samples}x",
                    info.backend, info.name, info.driver
@@ -848,6 +1006,10 @@ fn main() -> eframe::Result {
                open_documents::set_ui(&cc.egui_ctx);
                [files, open_documents::take()].concat()
            };
+            // No design given: the designs open at the last quit, when the preference asks (#5542).
+            // Not when driven over the control channel, whose clients expect a fresh design.
+            let files =
+                if files.is_empty() && !sample && control_port.is_none() { solidcraft_ui_egui::documents::designs_to_reopen(&app) } else { files };
            for f in &files {
                app.open_path_async(f);
            }
@@ -876,8 +1038,9 @@ fn main() -> eframe::Result {
            if !notes.is_empty() {
                app.set_status(notes.join(" "), true);
            }
+            let nav_bridge = nav_bridge::NavBridge::start(&cc.egui_ctx);
            #[cfg(any(target_os = "windows", target_os = "linux", target_os = "macos"))]
-            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx);
+            let space_mouse = space_mouse::SpaceMouse::start(&cc.egui_ctx, nav_bridge.claim());
            #[cfg(target_os = "macos")]
            let native_menu = match native_menu::NativeMenu::new(&app, &cc.egui_ctx) {
                Ok(menu) => Some(menu),
@@ -902,12 +1065,14 @@ fn main() -> eframe::Result {
                space_mouse,
                #[cfg(target_os = "macos")]
                native_menu,
+                nav_bridge,
+                dialog_folder,
            }))
        }),
    );
    control_server::remove_token_file();
    match result {
-        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, settings.as_deref()),
+        Err(e) if !created.load(std::sync::atomic::Ordering::SeqCst) => no_window(e, cpu_renderer, started, settings.as_deref()),
        r => r,
    }
 }
@@ -928,6 +1093,9 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
    let mut options = eframe::egui_wgpu::WgpuConfiguration::default();
    if let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &mut options.wgpu_setup {
        let env_set = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+        // A retry applies only to this launch. WGPU_BACKEND always has priority.
+        let retry = std::env::var(startup::RETRY_BACKEND_ENV).ok();
+        let preference = if cpu { preference } else { retry.as_deref().or(preference) };
        if let Some(backends) = startup::choose_backends(cfg!(target_os = "windows"), env_set, cpu, preference, startup::has_hardware_adapter) {
            eprintln!("SolidCraft graphics: starting {backends:?}");
            setup.instance_descriptor.backends = backends;
@@ -935,9 +1103,9 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
        let intel_mac = cfg!(all(target_os = "macos", target_arch = "x86_64"));
        let indirect = std::env::var(startup::INDIRECT_VALIDATION_ENV).ok();
        setup.instance_descriptor.flags = startup::window_instance_flags(setup.instance_descriptor.flags, intel_mac, indirect.as_deref());
-        if cpu {
-            setup.native_adapter_selector = Some(std::sync::Arc::new(startup::pick_cpu_adapter));
-        }
+        let environment = std::env::var("WGPU_ADAPTER_NAME").ok();
+        let adapter = graphics().and_then(|v| v.get("adapter").and_then(serde_json::Value::as_str).map(str::to_string));
+        startup::configure_adapter(setup, cpu, environment, adapter);
        // A float depth buffer with a stencil, wherever the adapter has it (see `FLOAT_DEPTH_BITS`).
        let base = setup.device_descriptor.clone();
        setup.device_descriptor = std::sync::Arc::new(move |adapter| {
@@ -949,24 +1117,47 @@ fn wgpu_options(cpu: bool, preference: Option<&str>) -> eframe::egui_wgpu::WgpuC
    options
 }

-/// The window never opened (no graphics adapter, a device that wouldn't start): once more on
-/// the software renderer, else a message box saying what failed instead of a silent exit.
-fn no_window(error: eframe::Error, tried_cpu: bool, settings: Option<&std::path::Path>) -> eframe::Result {
+/// A failed renderer returns here before app creation. A fresh process avoids reusing winit's
+/// event loop or a failed device; each retry advances through the APIs, then software once.
+fn no_window(error: eframe::Error, tried_cpu: bool, failed: eframe::wgpu::Backends, settings: Option<&std::path::Path>) -> eframe::Result {
    log::error!("the window could not open: {error}");
    eprintln!("SolidCraft: the window could not open: {error}");
-    if !tried_cpu && let Ok(exe) = std::env::current_exe() {
-        eprintln!("SolidCraft: trying again with the software renderer ({}=cpu)", startup::RENDERER_ENV);
-        match std::process::Command::new(exe).args(std::env::args_os().skip(1)).env(startup::RENDERER_ENV, "cpu").status() {
+    // This failure was handled, so neither the marker nor the journal should call it a crash.
+    if let Some(dir) = settings {
+        startup::started(dir);
+    }
+    solidcraft_engine::crash::end_session();
+    let explicit = std::env::var(startup::WGPU_BACKEND_ENV).is_ok_and(|v| !v.trim().is_empty());
+    if let Some(next) = startup::fallback_backend(cfg!(target_os = "windows"), explicit, tried_cpu, failed)
+        && let Ok(exe) = std::env::current_exe()
+    {
+        let previous = std::env::var(startup::FALLBACK_NOTE_ENV).unwrap_or_default();
+        let note = startup::fallback_note(&previous, failed, next, &error.to_string());
+        log::warn!("{note}");
+        eprintln!("SolidCraft: {note}");
+        let mut command = std::process::Command::new(exe);
+        command.args(std::env::args_os().skip(1)).env(startup::FALLBACK_NOTE_ENV, note);
+        if next == "cpu" {
+            command.env(startup::RENDERER_ENV, "cpu").env_remove(startup::RETRY_BACKEND_ENV);
+        } else {
+            command.env(startup::RETRY_BACKEND_ENV, next);
+        }
+        match command.status() {
            Ok(status) if status.success() => return Ok(()),
-            // The second try showed its own message.
+            // The final try showed its own message.
            Ok(_) => return Err(error),
-            Err(e) => log::error!("could not start again with the software renderer: {e}"),
+            Err(e) => log::error!("could not start again on {next}: {e}"),
        }
    }
+    let message = if explicit {
+        format!("SolidCraft could not open its window with WGPU_BACKEND.\n\n{error}\n\nChange or remove WGPU_BACKEND to try another graphics API.")
+    } else {
+        startup::no_window_message(&error.to_string(), settings)
+    };
    let _ = rfd::MessageDialog::new()
        .set_level(rfd::MessageLevel::Error)
        .set_title("SolidCraft could not start")
-        .set_description(startup::no_window_message(&error.to_string(), settings))
+        .set_description(message)
        .set_buttons(rfd::MessageButtons::Ok)
        .show();
    Err(error)
@@ -1054,6 +1245,40 @@ mod backend_tests {
    }
 }

+#[cfg(test)]
+mod dialog_folder_tests {
+    use super::DialogFolder;
+    use std::path::{Path, PathBuf};
+
+    /// #7756: a file dialog opens where the last one left off, not in the home folder.
+    #[test]
+    fn the_next_dialog_opens_in_the_folder_of_the_file_chosen_last() {
+        let folder = DialogFolder::default();
+        assert_eq!(folder.folder(), None, "before any choice the system decides");
+        folder.chosen(Path::new("/work/prints/bracket.stl"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/prints")));
+        // A bare file name has no folder to remember.
+        folder.chosen(Path::new("bracket.step"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/prints")));
+    }
+
+    /// Save As starts beside the open design (#7756), and a folder chosen since wins until another
+    /// design is opened or saved.
+    #[test]
+    fn the_open_design_moves_the_folder_only_when_it_changes() {
+        let folder = DialogFolder::default();
+        folder.design(Some("/work/lid/lid.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/lid")));
+        folder.chosen(Path::new("/exports/lid.3mf"));
+        folder.design(Some("/work/lid/lid.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/exports")), "the same design again leaves the export folder");
+        folder.design(None);
+        assert_eq!(folder.folder(), Some(PathBuf::from("/exports")), "a new, unsaved design has no folder of its own");
+        folder.design(Some("/work/base/base.solidcraft"));
+        assert_eq!(folder.folder(), Some(PathBuf::from("/work/base")));
+    }
+}
+
 #[cfg(test)]
 mod viewport_tests {
    #[cfg(target_os = "macos")]
@@ -1163,14 +1388,14 @@ mod msaa_tests {
        std::fs::create_dir_all(&legacy_eframe).unwrap();
        std::fs::write(legacy.join("graphics.json"), r#"{"msaa":8}"#).unwrap();
        std::fs::write(legacy_eframe.join("app.ron"), "(prefs)").unwrap();
-        super::adopt_settings(&current, None, &legacy, Some(&legacy_eframe)).unwrap();
+        super::adopt_settings(&current, &[], &legacy, Some(&legacy_eframe)).unwrap();
        assert_eq!(std::fs::read_to_string(current.join("graphics.json")).unwrap(), r#"{"msaa":8}"#);
        assert_eq!(std::fs::read_to_string(current.join("app.ron")).unwrap(), "(prefs)");
        assert!(legacy.join("graphics.json").is_file() && legacy_eframe.join("app.ron").is_file());
        // Later launches leave the current settings alone.
        std::fs::write(current.join("app.ron"), "(mine)").unwrap();
        std::fs::remove_file(current.join("graphics.json")).unwrap();
-        super::adopt_settings(&current, None, &legacy, Some(&legacy_eframe)).unwrap();
+        super::adopt_settings(&current, &[], &legacy, Some(&legacy_eframe)).unwrap();
        assert_eq!(std::fs::read_to_string(current.join("app.ron")).unwrap(), "(mine)");
        assert!(!current.join("graphics.json").exists());
        let _ = std::fs::remove_dir_all(&d);
@@ -1187,6 +1412,34 @@ mod msaa_tests {
        }
    }

+    #[test]
+    fn scene_sample_choices_include_the_scene_depth_format() {
+        use eframe::wgpu::TextureFormat;
+        for (bits, expected) in [(24, TextureFormat::Depth24PlusStencil8), (32, TextureFormat::Depth32FloatStencil8)] {
+            // A synthetic colour target supports 8x, but the scene depth supports only 1x/4x.
+            let supported = super::scene_sample_choices(bits, 8, |depth| match depth {
+                Some(format) if format == expected => vec![1, 4],
+                None => vec![1, 4, 8],
+                other => panic!("unexpected scene depth: {other:?}"),
+            });
+            assert_eq!(supported, [1, 4]);
+            assert_eq!(super::scene_samples(eframe::wgpu::Backend::Dx12, 8, &supported), 4);
+        }
+    }
+
+    #[test]
+    fn scene_msaa_keeps_four_samples_by_default_and_explicit_choices() {
+        use eframe::wgpu::Backend;
+        let default = super::scene_msaa_request(None);
+        assert_eq!(default, 4);
+        for backend in [Backend::Dx12, Backend::Vulkan, Backend::Metal] {
+            assert_eq!(super::scene_samples(backend, u32::from(default), &[1, 4]), 4);
+        }
+        for saved in [1, 2, 4, 8] {
+            assert_eq!(super::scene_msaa_request(Some(saved)), saved);
+        }
+    }
+
    #[test]
    fn the_scene_follows_the_backend_policy_too() {
        use eframe::wgpu::Backend;
@@ -0,0 +1,879 @@
+//! macOS: what a crash in native code leaves behind (docs/crash-reports.md).
+//!
+//! A crash inside a graphics driver or another library (a segfault, an `abort()`, a stack
+//! overflow) is no Rust panic: the panic hook never runs and the next start only found "an
+//! unclean exit". A signal handler for SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP (how a trap
+//! instruction arrives on Apple silicon) and SIGABRT now writes, before the process goes, the
+//! same small JSON file as the Windows filter (`native_crash.rs`): the signal, the faulting
+//! module and the offset into it, and a short frame-pointer walk, next to the run's crash journal
+//! (`solidcraft_engine::crash::native_paths`). The next start puts it into the unclean exit's
+//! report. The signal then goes on to the handler that was there before (the standard library's
+//! stack overflow message) or to the default action, so the process still dies of it and macOS
+//! still writes its own crash report (`~/Library/Logs/DiagnosticReports`; the file names the
+//! `pid` the JSON records).
+//!
+//! Installing a signal handler and asking dyld which image holds an address have no safe API,
+//! hence the `unsafe_code` allowance on this module (the app crate denies it). The handler runs
+//! on a thread that may have a broken heap, or on the small alternate stack after a stack
+//! overflow: it doesn't allocate, formats into a buffer on the stack, and only reads memory on
+//! the thread's own stack. It writes what it knows from the signal first and only then calls
+//! `dladdr` (not on POSIX's async-signal-safe list; it takes dyld's recursive reader lock and
+//! doesn't allocate) to name the modules, rewriting the file, so a hang or a fault in there
+//! still leaves a record.
+#![allow(unsafe_code)]
+
+use std::ffi::{CStr, CString, c_int, c_void};
+use std::fmt::Write as _;
+use std::os::unix::ffi::OsStrExt;
+use std::sync::OnceLock;
+use std::sync::atomic::{AtomicBool, AtomicI32, AtomicUsize, Ordering};
+
+use libc::{SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP, siginfo_t};
+
+/// The signals a crash arrives as, in the order of [`PREVIOUS`].
+const SIGNALS: [c_int; 6] = [SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGTRAP, SIGABRT];
+/// Frames the walk records (the faulting instruction first).
+const MAX_FRAMES: usize = 24;
+/// A fault this far below a thread's stack is taken for a stack overflow.
+const GUARD: usize = 64 << 10;
+
+/// Where the handler writes (NUL-terminated), set once by [`install`].
+static PATH: OnceLock<CString> = OnceLock::new();
+/// The handler that was installed before ours for each of [`SIGNALS`] (called after ours), as an
+/// address (`SIG_DFL` is 0, `SIG_IGN` 1), and its `sa_flags`.
+static PREVIOUS: [AtomicUsize; 6] = [const { AtomicUsize::new(libc::SIG_DFL) }; 6];
+static PREVIOUS_FLAGS: [AtomicI32; 6] = [const { AtomicI32::new(0) }; 6];
+/// The handler has started writing (a second signal while it does is only passed on).
+static BUSY: AtomicBool = AtomicBool::new(false);
+
+/// Catch native crashes from now on (after `solidcraft_engine::crash::install`; nothing without it).
+pub fn install() {
+    let Some((info, _)) = solidcraft_engine::crash::native_paths() else { return };
+    let Ok(path) = CString::new(info.as_os_str().as_bytes()) else { return };
+    if PATH.set(path).is_err() {
+        return;
+    }
+    for (slot, &signal) in SIGNALS.iter().enumerate() {
+        // SAFETY: `sigaction` is plain data; all zeros is a valid (empty) value.
+        let mut ours: libc::sigaction = unsafe { std::mem::zeroed() };
+        ours.sa_sigaction = handler as *const () as usize;
+        // On the alternate stack the standard library gives each of its threads, so that a stack
+        // overflow can still be recorded.
+        ours.sa_flags = libc::SA_SIGINFO | libc::SA_ONSTACK;
+        // SAFETY: as above.
+        let mut old: libc::sigaction = unsafe { std::mem::zeroed() };
+        // SAFETY: `handler` has the signature SA_SIGINFO calls it with and stays valid for the
+        // process's life; both structs are valid for the call.
+        if unsafe { libc::sigaction(signal, &ours, &mut old) } == 0
+            && old.sa_sigaction != ours.sa_sigaction
+            && let (Some(p), Some(f)) = (PREVIOUS.get(slot), PREVIOUS_FLAGS.get(slot))
+        {
+            f.store(old.sa_flags, Ordering::SeqCst);
+            p.store(old.sa_sigaction, Ordering::SeqCst);
+        }
+    }
+}
+
+/// The signal handler: record, then pass the signal on.
+unsafe extern "C" fn handler(signal: c_int, info: *mut siginfo_t, context: *mut c_void) {
+    // SAFETY: `__error` is this thread's errno, restored for whatever runs after us.
+    let errno = unsafe { *libc::__error() };
+    let slot = SIGNALS.iter().position(|&s| s == signal).unwrap_or(0);
+    let previous = PREVIOUS.get(slot).map_or(libc::SIG_DFL, |p| p.load(Ordering::SeqCst));
+    // SAFETY: the system passes a valid siginfo and the interrupted thread's context for the
+    // duration of an SA_SIGINFO handler.
+    let f = unsafe { fault(signal, info, context) };
+    // Someone sent a signal the app ignored before: still nothing to record.
+    let ignored = previous == libc::SIG_IGN && !f.fault;
+    if !ignored && !BUSY.swap(true, Ordering::SeqCst) {
+        record(&f);
+    }
+    // SAFETY: as above.
+    unsafe { pass_on(signal, slot, previous, f.fault, info, context) };
+    // SAFETY: as above.
+    unsafe { *libc::__error() = errno };
+}
+
+/// The signal comes from the faulting instruction itself (not `kill`, `raise` or `abort`), so
+/// returning runs it again: on arm64, the exception the thread last took matches the signal.
+/// macOS gives a SIGSEGV sent with `kill` the same `si_code` as a real one (SEGV_ACCERR), but
+/// the exception is then the thread's last system call (or something long past, whose fault
+/// address doesn't match).
+#[cfg(any(target_arch = "aarch64", test))]
+fn arm64_fault(signal: c_int, si_code: c_int, addr: usize, esr: u32, far: u64) -> bool {
+    const ABORTS: [u32; 4] = [0x20, 0x21, 0x24, 0x25];
+    const SVC: u32 = 0x15;
+    let class = esr >> 26;
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => ABORTS.contains(&class) && far as usize == addr,
+            _ => class != SVC && !ABORTS.contains(&class),
+        }
+}
+
+/// As [`arm64_fault`], from the x86 trap number and page-fault address.
+#[cfg(any(target_arch = "x86_64", test))]
+fn x86_fault(signal: c_int, si_code: c_int, addr: usize, trapno: u16, faultvaddr: u64) -> bool {
+    signal != SIGABRT
+        && (1..0x10000).contains(&si_code)
+        && match signal {
+            SIGSEGV | SIGBUS => (trapno == 14 && faultvaddr as usize == addr) || matches!(trapno, 12 | 13),
+            SIGILL => trapno == 6,
+            SIGFPE => matches!(trapno, 0 | 16 | 19),
+            SIGTRAP => matches!(trapno, 1 | 3),
+            _ => false,
+        }
+}
+
+/// Hand the signal to the previous handler, or to the default action. A crash signal that was
+/// only sent goes to the default action: the handler before ours (the standard library's, for
+/// SIGSEGV and SIGBUS) expects a fault that happens again when it returns.
+unsafe fn pass_on(signal: c_int, slot: usize, previous: usize, fault: bool, info: *mut siginfo_t, context: *mut c_void) {
+    let ours = handler as *const () as usize;
+    if previous != libc::SIG_DFL && previous != libc::SIG_IGN && previous != ours && (fault || signal == SIGABRT) {
+        let flags = PREVIOUS_FLAGS.get(slot).map_or(0, |f| f.load(Ordering::SeqCst));
+        if flags & libc::SA_SIGINFO != 0 {
+            // SAFETY: the address came from `sigaction` as an SA_SIGINFO handler.
+            let previous: unsafe extern "C" fn(c_int, *mut siginfo_t, *mut c_void) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal, info, context) };
+        } else {
+            // SAFETY: the address came from `sigaction` as a plain handler.
+            let previous: unsafe extern "C" fn(c_int) = unsafe { std::mem::transmute(previous) };
+            // SAFETY: as for this handler.
+            unsafe { previous(signal) };
+        }
+        return;
+    }
+    if previous == libc::SIG_IGN && !fault {
+        return;
+    }
+    // SAFETY: as in `install`.
+    let mut default: libc::sigaction = unsafe { std::mem::zeroed() };
+    default.sa_sigaction = libc::SIG_DFL;
+    // SAFETY: a valid struct; restoring the default action is async-signal-safe.
+    unsafe { libc::sigaction(signal, &default, std::ptr::null_mut()) };
+    // A fault happens again when we return, now with the default action, so macOS reports it at
+    // the instruction; anything else is raised again, and arrives once this handler returns.
+    if !fault {
+        // SAFETY: async-signal-safe.
+        unsafe { libc::raise(signal) };
+    }
+}
+
+/// The darwin `ucontext_t`, up to the pointer to the machine context (`<sys/_types/_ucontext.h>`).
+#[repr(C)]
+struct UContext {
+    _onstack: c_int,
+    _sigmask: u32,
+    _stack: libc::stack_t,
+    _link: *mut c_void,
+    _mcsize: usize,
+    mcontext: *const MContext,
+}
+
+/// The darwin arm64 machine context: exception state, then the general registers
+/// (`<mach/arm/_structs.h>`; the floating-point state that follows isn't read).
+#[cfg(target_arch = "aarch64")]
+#[repr(C)]
+struct MContext {
+    far: u64,
+    esr: u32,
+    _exception: u32,
+    _x: [u64; 29],
+    fp: u64,
+    _lr: u64,
+    _sp: u64,
+    pc: u64,
+}
+
+/// The darwin x86_64 machine context: exception state, then the general registers
+/// (`<mach/i386/_structs.h>`; rax rbx rcx rdx rdi rsi rbp rsp r8–r15, then rip).
+#[cfg(target_arch = "x86_64")]
+#[repr(C)]
+struct MContext {
+    trapno: u16,
+    _cpu: u16,
+    err: u32,
+    faultvaddr: u64,
+    gpr: [u64; 16],
+    rip: u64,
+}
+
+/// What the faulting instruction did to its address, when the processor says.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Access {
+    Unknown,
+    Read,
+    Write,
+    Execute,
+}
+
+/// What a crash signal says, read out of the signal before anything is looked up.
+#[derive(Clone, Copy, Debug)]
+struct Fault {
+    signal: c_int,
+    si_code: c_int,
+    /// `si_addr`: the address that faulted (for SIGILL, SIGFPE and SIGTRAP, the instruction).
+    addr: usize,
+    pc: usize,
+    fp: usize,
+    access: Access,
+    /// It comes from the faulting instruction (not `kill`, `raise` or `abort`).
+    fault: bool,
+    /// The process that sent the signal (0 or our own for a fault or an `abort()`).
+    sender: i32,
+    pid: i32,
+    thread: u64,
+    thread_name: [u8; 64],
+    /// The thread's stack, `[low, high)` (0, 0 when unknown).
+    stack: (usize, usize),
+}
+
+impl Fault {
+    /// The fault hit just below the thread's stack: the stack ran out.
+    fn overflow(&self) -> bool {
+        let (low, high) = self.stack;
+        matches!(self.signal, SIGSEGV | SIGBUS) && high > low && self.addr < low.saturating_add(4096) && self.addr >= low.saturating_sub(GUARD)
+    }
+
+    fn signal_name(&self) -> &'static str {
+        match self.signal {
+            SIGSEGV => "SIGSEGV",
+            SIGBUS => "SIGBUS",
+            SIGILL => "SIGILL",
+            SIGFPE => "SIGFPE",
+            SIGTRAP => "SIGTRAP",
+            SIGABRT => "SIGABRT",
+            _ => "signal",
+        }
+    }
+
+    fn name(&self) -> &'static str {
+        if self.overflow() {
+            return "stack overflow";
+        }
+        match self.signal {
+            SIGSEGV => "segmentation fault",
+            SIGBUS => "bus error",
+            SIGILL => "illegal instruction",
+            SIGFPE => "arithmetic exception",
+            SIGTRAP => "trap",
+            SIGABRT => "abort",
+            _ => "signal",
+        }
+    }
+
+    /// The `si_code` names that say something about a crash.
+    fn code_name(&self) -> Option<&'static str> {
+        Some(match (self.signal, self.si_code) {
+            (SIGSEGV, 1) => "SEGV_MAPERR",
+            (SIGSEGV, 2) => "SEGV_ACCERR",
+            (SIGBUS, 1) => "BUS_ADRALN",
+            (SIGBUS, 2) => "BUS_ADRERR",
+            (SIGBUS, 3) => "BUS_OBJERR",
+            (SIGFPE, 7) => "FPE_INTDIV",
+            (SIGFPE, 8) => "FPE_INTOVF",
+            _ => return None,
+        })
+    }
+
+    /// One line on what happened: the address read or written, a stack overflow, who sent it.
+    fn detail(&self, b: &mut Buf) {
+        if self.sender != 0 && self.sender != self.pid {
+            let _ = write!(b, "sent by process {}", self.sender);
+            return;
+        }
+        if !self.fault {
+            if self.signal != SIGABRT {
+                let _ = b.write_str("sent with kill or raise, not a fault");
+            }
+            return;
+        }
+        let what = match self.access {
+            Access::Read => "read of",
+            Access::Write => "write to",
+            Access::Execute => "execution at",
+            Access::Unknown => "access to",
+        };
+        if self.overflow() {
+            let _ = write!(b, "{what} 0x{:016X}, below the thread's stack", self.addr);
+        } else if matches!(self.signal, SIGSEGV | SIGBUS) {
+            let _ = write!(b, "{what} 0x{:016X}", self.addr);
+        } else {
+            let _ = write!(b, "at 0x{:016X}", self.addr);
+        }
+        if let Some(c) = self.code_name() {
+            let _ = write!(b, " ({c})");
+        }
+    }
+}
+
+/// An image that holds an address, as `dladdr` names it.
+struct Module<'a> {
+    path: &'a [u8],
+    base: usize,
+    symbol: Option<(&'a [u8], usize)>,
+}
+
+/// A fixed buffer to format into without allocating (what doesn't fit is cut off).
+struct Buf {
+    bytes: [u8; 8192],
+    len: usize,
+}
+
+impl Buf {
+    fn new() -> Buf {
+        Buf { bytes: [0; 8192], len: 0 }
+    }
+
+    fn room(&self) -> usize {
+        self.bytes.len().saturating_sub(self.len)
+    }
+
+    fn as_bytes(&self) -> &[u8] {
+        self.bytes.get(..self.len).unwrap_or_default()
+    }
+
+    /// `s` as the inside of a JSON string, at most `max` bytes of it (bytes that aren't UTF-8
+    /// and control characters become `?`).
+    fn escaped(&mut self, s: &[u8], max: usize) {
+        for chunk in s.get(..s.len().min(max)).unwrap_or_default().utf8_chunks() {
+            for c in chunk.valid().chars() {
+                let _ = match c {
+                    '"' => self.write_str("\\\""),
+                    '\\' => self.write_str("\\\\"),
+                    c if (c as u32) < 0x20 => self.write_str("?"),
+                    c => self.write_char(c),
+                };
+            }
+            if !chunk.invalid().is_empty() {
+                let _ = self.write_str("?");
+            }
+        }
+    }
+}
+
+impl std::fmt::Write for Buf {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        let n = s.len().min(self.room());
+        if let (Some(to), Some(from)) = (self.bytes.get_mut(self.len..self.len + n), s.as_bytes().get(..n)) {
+            to.copy_from_slice(from);
+            self.len += n;
+        }
+        Ok(())
+    }
+}
+
+/// The last part of a path.
+fn file_name(path: &[u8]) -> &[u8] {
+    path.rsplit(|&c| c == b'/').next().unwrap_or(path)
+}
+
+/// The report: what the signal says, then (with `resolve`) the module of the faulting
+/// instruction and the `frames`. Always valid JSON: frames stop while there is room to close it.
+fn json(b: &mut Buf, f: &Fault, frames: &[usize], resolve: impl Fn(usize, bool) -> Option<Module<'static>>) {
+    let signal = f.signal_name();
+    let _ = write!(b, "{{\"signal\":\"{signal}\",\"number\":{},\"code\":\"{signal}\",\"name\":\"{}\"", f.signal, f.name());
+    let _ = write!(b, ",\"si_code\":{},\"address\":\"0x{:016X}\",\"thread\":{},\"pid\":{}", f.si_code, f.pc, f.thread, f.pid);
+    let name = f.thread_name.split(|&c| c == 0).next().unwrap_or_default();
+    if !name.is_empty() {
+        let _ = b.write_str(",\"thread_name\":\"");
+        b.escaped(name, 64);
+        let _ = b.write_str("\"");
+    }
+    let mark = b.len;
+    let _ = b.write_str(",\"detail\":\"");
+    let start = b.len;
+    f.detail(b);
+    if b.len == start {
+        b.len = mark;
+    } else {
+        let _ = b.write_str("\"");
+    }
+    if let Some(m) = resolve(f.pc, false) {
+        let _ = write!(b, ",\"offset\":\"0x{:X}\",\"module\":\"", f.pc.wrapping_sub(m.base));
+        b.escaped(m.path, 300);
+        let _ = b.write_str("\"");
+    }
+    if !frames.is_empty() {
+        let _ = b.write_str(",\"frames\":[");
+        for (i, &at) in frames.iter().enumerate() {
+            // A frame is at most ~300 bytes; keep room for it and the closing `]}`.
+            if b.room() < 400 {
+                break;
+            }
+            if i > 0 {
+                let _ = b.write_str(",");
+            }
+            let _ = b.write_str("\"");
+            // A return address points after the call: look up the call itself.
+            match resolve(at, i > 0) {
+                Some(m) => {
+                    b.escaped(file_name(m.path), 100);
+                    let _ = write!(b, "+0x{:X}", at.wrapping_sub(m.base));
+                    if let Some((symbol, start)) = m.symbol {
+                        let _ = b.write_str(" ");
+                        b.escaped(symbol, 160);
+                        let _ = write!(b, "+0x{:X}", at.wrapping_sub(start));
+                    }
+                }
+                None => {
+                    let _ = write!(b, "0x{at:016X}");
+                }
+            }
+            let _ = b.write_str("\"");
+        }
+        let _ = b.write_str("]");
+    }
+    let _ = b.write_str("}");
+}
+
+/// The return addresses up the frame-pointer chain from `fp`, after `pc`. `read` gives the word
+/// at an address; frames outside `stack`, misaligned or not going up end the walk.
+fn walk(pc: usize, fp: usize, stack: (usize, usize), read: impl Fn(usize) -> Option<usize>, out: &mut [usize; MAX_FRAMES]) -> usize {
+    let (low, high) = stack;
+    let mut n = 0;
+    if let Some(slot) = out.get_mut(n) {
+        *slot = pc;
+        n += 1;
+    }
+    let mut fp = fp;
+    while n < MAX_FRAMES {
+        let in_stack = fp >= low && fp.checked_add(16).is_some_and(|end| end <= high);
+        if !fp.is_multiple_of(8) || !in_stack {
+            break;
+        }
+        let (Some(next), Some(ret)) = (read(fp), read(fp + 8)) else { break };
+        let ret = strip_pointer_auth(ret);
+        if ret == 0 {
+            break;
+        }
+        if let Some(slot) = out.get_mut(n) {
+            *slot = ret;
+            n += 1;
+        }
+        if next <= fp {
+            break;
+        }
+        fp = next;
+    }
+    n
+}
+
+/// Return addresses saved by arm64e code carry a signature in their top bits.
+fn strip_pointer_auth(addr: usize) -> usize {
+    if cfg!(target_arch = "aarch64") { addr & 0x0000_7FFF_FFFF_FFFF } else { addr }
+}
+
+/// Read what the signal and the interrupted thread's registers say.
+unsafe fn fault(signal: c_int, info: *const siginfo_t, context: *const c_void) -> Fault {
+    let mut f = Fault {
+        signal,
+        si_code: 0,
+        addr: 0,
+        pc: 0,
+        fp: 0,
+        access: Access::Unknown,
+        fault: false,
+        sender: 0,
+        // SAFETY: async-signal-safe.
+        pid: unsafe { libc::getpid() },
+        thread: 0,
+        thread_name: [0; 64],
+        stack: (0, 0),
+    };
+    if !info.is_null() {
+        // SAFETY: the system passes a valid siginfo for the duration of the handler.
+        let info = unsafe { &*info };
+        f.si_code = info.si_code;
+        f.addr = info.si_addr as usize;
+        f.sender = info.si_pid;
+        // Without registers (never seen), the signal's own code has to do.
+        f.fault = signal != SIGABRT && (1..0x10000).contains(&f.si_code);
+    }
+    let context = context as *const UContext;
+    // SAFETY: an SA_SIGINFO handler's third argument is the interrupted thread's ucontext, whose
+    // machine context pointer the kernel fills in.
+    let mcontext = if context.is_null() { std::ptr::null() } else { unsafe { (*context).mcontext } };
+    if !mcontext.is_null() {
+        // SAFETY: as above.
+        let m = unsafe { &*mcontext };
+        #[cfg(target_arch = "aarch64")]
+        {
+            f.pc = strip_pointer_auth(m.pc as usize);
+            f.fp = m.fp as usize;
+            f.fault = arm64_fault(signal, f.si_code, f.addr, m.esr, m.far);
+            // A data abort says whether it was a write (WnR); an instruction abort is execution.
+            f.access = match m.esr >> 26 {
+                0x24 | 0x25 if m.esr & (1 << 6) != 0 => Access::Write,
+                0x24 | 0x25 => Access::Read,
+                0x20 | 0x21 => Access::Execute,
+                _ => Access::Unknown,
+            };
+        }
+        #[cfg(target_arch = "x86_64")]
+        {
+            f.pc = m.rip as usize;
+            f.fp = m.gpr.get(6).copied().unwrap_or(0) as usize;
+            f.fault = x86_fault(signal, f.si_code, f.addr, m.trapno, m.faultvaddr);
+            // A page fault's error code: bit 4 instruction fetch, bit 1 write.
+            f.access = match (m.trapno, m.err) {
+                (14, e) if e & 0x10 != 0 => Access::Execute,
+                (14, e) if e & 0x2 != 0 => Access::Write,
+                (14, _) => Access::Read,
+                _ => Access::Unknown,
+            };
+        }
+    }
+    if f.pc == 0 && matches!(signal, SIGILL | SIGFPE | SIGTRAP) {
+        f.pc = f.addr;
+    }
+    // SAFETY: these read the calling thread's own pthread structure; the buffers are as long as
+    // we say.
+    unsafe {
+        let me = libc::pthread_self();
+        libc::pthread_threadid_np(me, &mut f.thread);
+        libc::pthread_getname_np(me, f.thread_name.as_mut_ptr().cast(), f.thread_name.len());
+        let high = libc::pthread_get_stackaddr_np(me) as usize;
+        let size = libc::pthread_get_stacksize_np(me);
+        if let Some(low) = high.checked_sub(size) {
+            f.stack = (low, high);
+        }
+    }
+    f
+}
+
+/// The image that holds `addr` (the call before it, for a return address).
+fn resolve(addr: usize, return_address: bool) -> Option<Module<'static>> {
+    let at = if return_address { addr.saturating_sub(1) } else { addr };
+    // SAFETY: `Dl_info` is plain data; all zeros is a valid value.
+    let mut info: libc::Dl_info = unsafe { std::mem::zeroed() };
+    // SAFETY: `dladdr` only reads dyld's image list; the strings it returns live as long as the
+    // image, which a crashing process never unloads.
+    unsafe {
+        if libc::dladdr(at as *const c_void, &mut info) == 0 || info.dli_fname.is_null() {
+            return None;
+        }
+        let symbol = (!info.dli_sname.is_null()).then(|| (CStr::from_ptr(info.dli_sname).to_bytes(), info.dli_saddr as usize));
+        Some(Module { path: CStr::from_ptr(info.dli_fname).to_bytes(), base: info.dli_fbase as usize, symbol })
+    }
+}
+
+/// Write what the signal says into the info file, then again with the modules and frames.
+fn record(f: &Fault) {
+    let Some(path) = PATH.get() else { return };
+    // SAFETY: NUL-terminated path; the descriptor is closed below.
+    let fd = unsafe { libc::open(path.as_ptr(), libc::O_WRONLY | libc::O_CREAT | libc::O_TRUNC | libc::O_CLOEXEC, 0o600) };
+    if fd < 0 {
+        return;
+    }
+    let mut b = Buf::new();
+    json(&mut b, f, &[], |_, _| None);
+    let bytes = b.as_bytes();
+    // SAFETY: the buffer is as long as we say.
+    unsafe { libc::write(fd, bytes.as_ptr().cast(), bytes.len()) };
+    let mut frames = [0usize; MAX_FRAMES];
+    // SAFETY: `walk` only reads inside the thread's own stack, 8-byte aligned.
+    let n = walk(f.pc, f.fp, f.stack, |at| Some(unsafe { (at as *const usize).read() }), &mut frames);
+    b.len = 0;
+    json(&mut b, f, frames.get(..n).unwrap_or_default(), resolve);
+    let bytes = b.as_bytes();
+    // SAFETY: as above.
+    unsafe {
+        if libc::pwrite(fd, bytes.as_ptr().cast(), bytes.len(), 0) == bytes.len() as isize {
+            libc::ftruncate(fd, bytes.len() as libc::off_t);
+        }
+        libc::close(fd);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::process::ExitStatusExt;
+    use std::path::{Path, PathBuf};
+
+    use super::*;
+
+    fn fault(signal: c_int, si_code: c_int, addr: usize) -> Fault {
+        let mut thread_name = [0u8; 64];
+        thread_name[..4].copy_from_slice(b"main");
+        Fault {
+            signal,
+            si_code,
+            addr,
+            pc: 0x1_0000_1234,
+            fp: 0,
+            access: Access::Read,
+            fault: true,
+            sender: 0,
+            pid: 77,
+            thread: 4242,
+            thread_name,
+            stack: (0x7000_0000, 0x7080_0000),
+        }
+    }
+
+    fn report(f: &Fault, frames: &[usize]) -> serde_json::Value {
+        let mut b = Buf::new();
+        json(&mut b, f, frames, |at, _| {
+            (at >= 0x1_0000_0000).then_some(Module {
+                path: b"/Applications/SolidCraft.app/Contents/MacOS/solidcraft",
+                base: 0x1_0000_0000,
+                symbol: Some((b"_ZN4main17h0123456789abcdefE", 0x1_0000_1200)),
+            })
+        });
+        serde_json::from_slice(b.as_bytes()).unwrap()
+    }
+
+    #[test]
+    fn a_segfault_says_the_signal_the_address_read_and_the_module() {
+        let v = report(&fault(SIGSEGV, 1, 0x10), &[0x1_0000_1234, 0x1_0000_2000, 0x5000]);
+        assert_eq!(v["signal"], "SIGSEGV");
+        assert_eq!(v["code"], "SIGSEGV");
+        assert_eq!(v["name"], "segmentation fault");
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_MAPERR)");
+        assert_eq!(v["address"], "0x0000000100001234");
+        assert_eq!(v["module"], "/Applications/SolidCraft.app/Contents/MacOS/solidcraft");
+        assert_eq!(v["offset"], "0x1234");
+        assert_eq!(v["thread"], 4242);
+        assert_eq!(v["thread_name"], "main");
+        assert_eq!(v["pid"], 77);
+        let frames: Vec<&str> = v["frames"].as_array().unwrap().iter().map(|f| f.as_str().unwrap()).collect();
+        assert_eq!(
+            frames,
+            ["solidcraft+0x1234 _ZN4main17h0123456789abcdefE+0x34", "solidcraft+0x2000 _ZN4main17h0123456789abcdefE+0xE00", "0x0000000000005000"]
+        );
+    }
+
+    #[test]
+    fn a_fault_below_the_stack_is_a_stack_overflow() {
+        let mut f = fault(SIGBUS, 2, 0x7000_0000 - 0x100);
+        f.access = Access::Write;
+        let v = report(&f, &[]);
+        assert_eq!(v["name"], "stack overflow");
+        assert_eq!(v["code"], "SIGBUS");
+        assert_eq!(v["detail"], "write to 0x000000006FFFFF00, below the thread's stack (BUS_ADRERR)");
+        // Far below it, or inside it, it is not.
+        assert_eq!(report(&fault(SIGBUS, 2, 0x10), &[])["name"], "bus error");
+        assert_eq!(report(&fault(SIGSEGV, 2, 0x7040_0000), &[])["name"], "segmentation fault");
+        // Nor without knowing the stack.
+        let mut f = fault(SIGSEGV, 1, 0x7000_0000 - 0x100);
+        f.stack = (0, 0);
+        assert_eq!(report(&f, &[])["name"], "segmentation fault");
+    }
+
+    #[test]
+    fn an_abort_or_a_signal_sent_by_another_process_has_no_address_detail() {
+        let mut f = fault(SIGABRT, 0, 0);
+        f.fault = false;
+        f.sender = 77;
+        let v = report(&f, &[]);
+        assert_eq!(v["signal"], "SIGABRT");
+        assert_eq!(v["name"], "abort");
+        assert!(v.get("detail").is_none(), "{v}");
+        let mut f = fault(SIGSEGV, 0x10001, 0);
+        f.fault = false;
+        f.sender = 501;
+        assert_eq!(report(&f, &[])["detail"], "sent by process 501");
+        // `kill` without a sender, or `raise`.
+        f.sender = 0;
+        assert_eq!(report(&f, &[])["detail"], "sent with kill or raise, not a fault");
+        // A trap names the instruction.
+        assert_eq!(report(&fault(SIGTRAP, 1, 0x1_0000_1234), &[])["detail"], "at 0x0000000100001234");
+    }
+
+    #[test]
+    fn only_a_fault_runs_again_when_the_handler_returns() {
+        // Measured on an M5 Pro, macOS 27: a read of address 16, then `kill -SEGV` while the
+        // thread waits in a system call. Both have si_code 2.
+        assert!(arm64_fault(SIGSEGV, 2, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x5600_0080, 0));
+        assert!(!arm64_fault(SIGBUS, 1, 0, 0x5600_0080, 0));
+        // A data abort long past, while the signal names no address.
+        assert!(!arm64_fault(SIGSEGV, 2, 0, 0x9200_0046, 0x10));
+        // A trap instruction (BRK) or an undefined one; but not a system call.
+        assert!(arm64_fault(SIGTRAP, 1, 0x1000, 0xF200_0001, 0));
+        assert!(arm64_fault(SIGILL, 1, 0x1000, 0x0200_0000, 0));
+        assert!(!arm64_fault(SIGILL, 1, 0x1000, 0x5600_0080, 0));
+        // Sent: SI_USER, no code, or an abort.
+        assert!(!arm64_fault(SIGSEGV, 0x10001, 0x10, 0x9200_0046, 0x10));
+        assert!(!arm64_fault(SIGTRAP, 0, 0, 0xF200_0001, 0));
+        assert!(!arm64_fault(SIGABRT, 1, 0, 0x5600_0080, 0));
+        // x86_64: a page fault at its address, a general protection fault, ud2, int3.
+        assert!(x86_fault(SIGSEGV, 1, 0x10, 14, 0x10));
+        assert!(!x86_fault(SIGSEGV, 1, 0, 14, 0x10));
+        assert!(x86_fault(SIGSEGV, 1, 0, 13, 0));
+        assert!(x86_fault(SIGILL, 1, 0x1000, 6, 0));
+        assert!(x86_fault(SIGTRAP, 1, 0x1000, 3, 0));
+        assert!(!x86_fault(SIGILL, 1, 0x1000, 14, 0));
+    }
+
+    #[test]
+    fn names_with_quotes_control_characters_or_bad_utf8_stay_valid_json() {
+        let mut f = fault(SIGILL, 1, 0x1_0000_1234);
+        f.thread_name = [0; 64];
+        f.thread_name[..7].copy_from_slice(b"a\"b\\\n\xFFc");
+        let v = report(&f, &[]);
+        assert_eq!(v["thread_name"], "a\"b\\??c");
+    }
+
+    #[test]
+    fn a_report_with_long_names_still_closes_its_json() {
+        let long: &'static [u8] = Box::leak(vec![b'x'; 4000].into_boxed_slice());
+        let f = fault(SIGSEGV, 1, 0x10);
+        let mut b = Buf::new();
+        json(&mut b, &f, &[0x1_0000_1234; MAX_FRAMES], |_, _| Some(Module { path: long, base: 0x1_0000_0000, symbol: Some((long, 0x1_0000_0000)) }));
+        let v: serde_json::Value = serde_json::from_slice(b.as_bytes()).unwrap();
+        assert_eq!(v["module"].as_str().unwrap().len(), 300);
+        let frames = v["frames"].as_array().unwrap();
+        assert!(!frames.is_empty() && frames.len() <= MAX_FRAMES, "{}", frames.len());
+    }
+
+    #[test]
+    fn the_frame_walk_stays_on_the_stack_and_goes_up() {
+        let stack = (0x1000, 0x2000);
+        // Three frames: 0x1100 -> 0x1200 -> 0x1300 -> 0 (end).
+        let memory = |at: usize| match at {
+            0x1100 => Some(0x1200),
+            0x1108 => Some(0xA),
+            0x1200 => Some(0x1300),
+            0x1208 => Some(0xB),
+            0x1300 => Some(0),
+            0x1308 => Some(0xC),
+            _ => None,
+        };
+        let mut out = [0; MAX_FRAMES];
+        let n = walk(0x9, 0x1100, stack, memory, &mut out);
+        assert_eq!(&out[..n], &[0x9, 0xA, 0xB, 0xC]);
+        // A frame pointer off the stack, misaligned, or one that doesn't go up ends the walk.
+        assert_eq!(walk(0x9, 0x3000, stack, memory, &mut out), 1);
+        assert_eq!(walk(0x9, 0x1101, stack, memory, &mut out), 1);
+        let looping = |at: usize| if at.is_multiple_of(16) { Some(at) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1100, stack, looping, &mut out), 2);
+        // A chain that never ends stops at MAX_FRAMES.
+        let endless = |at: usize| if at.is_multiple_of(16) { Some(at + 16) } else { Some(0xA) };
+        assert_eq!(walk(0x9, 0x1000, stack, endless, &mut out), MAX_FRAMES);
+    }
+
+    /// The child half: install crash reporting and the handler, then crash the way
+    /// `SOLIDCRAFT_NATIVE_CRASH_FAULT` says.
+    #[test]
+    fn child() {
+        let Some(dir) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_CHILD") else { return };
+        let build = solidcraft_engine::crash::Build { version: "9.9.9", commit: "abc1234", built: "2026-10-25" };
+        let fresh = solidcraft_engine::crash::install(PathBuf::from(dir), build);
+        println!("FRESH {}", serde_json::to_string(&fresh).unwrap_or_default());
+        let Some(fault) = std::env::var_os("SOLIDCRAFT_NATIVE_CRASH_FAULT") else {
+            solidcraft_engine::crash::end_session();
+            return;
+        };
+        super::install();
+        solidcraft_engine::crash::phase("device creation");
+        match fault.to_str() {
+            Some("abort") => std::process::abort(),
+            Some("overflow") => println!("unreachable {}", recurse(0)),
+            Some("raise") => {
+                // SAFETY: none needed; this is the crash under test.
+                unsafe { libc::raise(SIGSEGV) };
+                println!("survived");
+            }
+            _ => segfault(),
+        }
+    }
+
+    /// Runs out of stack.
+    #[inline(never)]
+    fn recurse(n: u64) -> u64 {
+        let a = std::hint::black_box([n; 64]);
+        if n == u64::MAX { 0 } else { recurse(n + 1).wrapping_add(a[0]) }
+    }
+
+    /// The crash under test: a read of address 16, as a null struct pointer's field would be.
+    #[inline(never)]
+    fn segfault() {
+        // SAFETY: none; this is the crash under test.
+        let v = unsafe { std::ptr::read_volatile(std::hint::black_box(16usize) as *const u64) };
+        println!("unreachable {v}");
+    }
+
+    fn run(dir: &Path, fault: Option<&str>) -> std::process::Output {
+        let mut c = std::process::Command::new(std::env::current_exe().unwrap());
+        c.args(["--exact", "native_crash_macos::tests::child", "--test-threads=1", "--nocapture"]).env("SOLIDCRAFT_NATIVE_CRASH_CHILD", dir);
+        if let Some(f) = fault {
+            c.env("SOLIDCRAFT_NATIVE_CRASH_FAULT", f);
+        }
+        c.output().unwrap()
+    }
+
+    /// Crash a child the way `fault` says; returns what the handler wrote and the next start's report.
+    fn crash(name: &str, fault: &str, signal: c_int) -> (serde_json::Value, serde_json::Value, String) {
+        let dir = std::env::temp_dir().join(format!("solidcraft-native-crash-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let out = run(&dir, Some(fault));
+        assert_eq!(out.status.signal(), Some(signal), "the child died of the signal itself: {out:?}");
+        let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+        let info =
+            std::fs::read_dir(dir.join("sessions")).unwrap().flatten().map(|e| e.path()).find(|p| p.to_string_lossy().ends_with(".native.json"));
+        let info = info.expect("the handler wrote what it caught");
+        let v: serde_json::Value = serde_json::from_slice(&std::fs::read(info).unwrap()).unwrap();
+        // The next start reports it.
+        let out = run(&dir, None);
+        assert!(out.status.success(), "{out:?}");
+        let reports = solidcraft_engine::crash::list(&dir);
+        assert_eq!(reports.len(), 1, "{reports:?}");
+        let r = solidcraft_engine::crash::read(&dir, &reports[0].id).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+        (v, r, stderr)
+    }
+
+    #[test]
+    fn a_segfault_is_reported_with_its_signal_module_frames_and_step() {
+        let (v, r, _) = crash("segv", "segv", SIGSEGV);
+        assert_eq!(v["signal"], "SIGSEGV", "{v}");
+        // Address 16 is in __PAGEZERO, mapped without access: SEGV_ACCERR.
+        assert_eq!(v["detail"], "read of 0x0000000000000010 (SEGV_ACCERR)", "{v}");
+        assert!(v["module"].as_str().unwrap().contains("solidcraft"), "the fault is in the test binary: {v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.len() >= 3, "{v}");
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("child")), "the walk reaches the test that crashed: {v}");
+        let message = r["message"].as_str().unwrap();
+        assert!(message.contains("segmentation fault (SIGSEGV) in solidcraft"), "{r}");
+        assert!(message.contains("during startup (device creation"), "{r}");
+        assert_eq!(r["kind"], "unclean_exit");
+        assert_eq!(r["native"]["signal"], "SIGSEGV");
+        assert!(r["backtrace"].as_array().unwrap().iter().any(|f| f.as_str().unwrap().contains("segfault")), "{r}");
+    }
+
+    #[test]
+    fn an_abort_is_reported_as_sigabrt_with_the_code_that_called_it() {
+        let (v, r, _) = crash("abrt", "abort", SIGABRT);
+        assert_eq!(v["signal"], "SIGABRT", "{v}");
+        assert!(v.get("detail").is_none(), "{v}");
+        let frames = v["frames"].as_array().unwrap();
+        assert!(frames.iter().any(|f| f.as_str().unwrap().contains("abort")), "{v}");
+        assert!(r["message"].as_str().unwrap().contains("abort (SIGABRT)"), "{r}");
+    }
+
+    #[test]
+    fn a_stack_overflow_is_recorded_and_the_standard_library_still_says_so() {
+        // The fault on the guard page is recorded on the alternate stack; the standard library's
+        // handler, called after ours, prints its message and aborts.
+        let (v, r, stderr) = crash("overflow", "overflow", SIGABRT);
+        assert!(matches!(v["signal"].as_str(), Some("SIGSEGV" | "SIGBUS")), "{v}");
+        assert_eq!(v["name"], "stack overflow", "{v}");
+        assert!(v["detail"].as_str().unwrap().contains("below the thread's stack"), "{v}");
+        assert!(stderr.contains("has overflowed its stack"), "{stderr}");
+        assert!(r["message"].as_str().unwrap().contains("stack overflow ("), "{r}");
+    }
+
+    #[test]
+    fn a_segfault_signal_that_was_only_sent_still_ends_the_app() {
+        // The standard library's handler, which comes before ours, returns expecting the fault
+        // to happen again; a sent signal never does, so it goes to the default action instead.
+        let (v, r, _) = crash("raise", "raise", SIGSEGV);
+        assert_eq!(v["detail"], "sent with kill or raise, not a fault", "{v}");
+        assert!(r["message"].as_str().unwrap().contains("(SIGSEGV)"), "{r}");
+    }
+}
@@ -146,8 +146,7 @@ impl NativeMenu {
    }

    fn action_enabled(action: &FileAction, app: &SolveApp, ctx: &egui::Context) -> bool {
-        action.enabled(app)
-            || (matches!(action, FileAction::Undo | FileAction::Redo) && ctx.egui_wants_keyboard_input() && FileAction::Settings.enabled(app))
+        action.menu_enabled(app, ctx.egui_wants_keyboard_input())
    }

    pub fn tick(&mut self, app: &mut SolveApp, ctx: &egui::Context) {
@@ -157,6 +156,12 @@ impl NativeMenu {
                item.set_enabled(enabled);
            }
        }
+        for (item, action) in &self.help_actions {
+            let enabled = solidcraft_ui_egui::help::available(app, action);
+            if item.is_enabled() != enabled {
+                item.set_enabled(enabled);
+            }
+        }
        if !self.recent_paths.iter().eq(app.home.recent.iter().take(32))
            && let Err(error) = self.update_recent(app)
        {
@@ -0,0 +1,463 @@
+//! The navigation bridge: a 3D input device's own program (a homemade device's driver app) moves
+//! the view over a loopback connection, the way a 3D mouse driver hands its axes to the programs
+//! it supports, so the device emulates no mouse and the pointer stays the user's.
+//!
+//! The device app listens on `127.0.0.1:<port>`; with Preferences › Navigation › "Navigate with a
+//! device app" on (off by default), SolidCraft connects to it, says hello and reads one JSON
+//! object per line (docs/3d-mouse.md). The reader thread only sums the motion; the egui thread
+//! hands it to the view once per frame (`space_mouse::bridge_frame`). A device the app says it
+//! reads is left to it by the 3D mouse reader ([`Claim`]), so the view doesn't move twice.
+
+use std::io::{ErrorKind, Read, Write};
+use std::net::{Ipv4Addr, SocketAddr, TcpStream};
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::Duration;
+
+use egui::Context;
+use serde_json::{Value, json};
+use solidcraft_ui_egui::SolveApp;
+use solidcraft_ui_egui::space_mouse::{BRIDGE_VIEWS, BridgeMotion, bridge_frame, bridge_step};
+
+/// The longest line read; a longer one is skipped to its end.
+const MAX_LINE: usize = 4096;
+/// Standard views waiting for the next frame; past this many, more are a flood and dropped.
+const MAX_VIEWS: usize = 8;
+/// The longest name a device app may give for itself or its device, in characters.
+const MAX_NAME: usize = 64;
+/// How long a connection attempt waits.
+const CONNECT_TIMEOUT: Duration = Duration::from_millis(500);
+/// How long a read waits for data before the reader looks at the preferences again.
+const READ_WAKE: Duration = Duration::from_millis(250);
+/// The wait before connecting again when no device app answered or one went away.
+const RETRY_AFTER: Duration = Duration::from_secs(1);
+/// In zoom mode, a motion of this many points along Y is one zoom step: with 8 % a step, the 1 %
+/// a point that a zoom drag moves.
+const POINTS_PER_ZOOM_STEP: f64 = 8.0;
+
+/// What the device's motion drives, as the device app last said (`mode`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum Mode {
+    #[default]
+    Orbit,
+    Pan,
+    Zoom,
+}
+
+/// What the reader thread and the egui thread share.
+#[derive(Debug, Default)]
+struct Shared {
+    /// The port the preferences ask to connect to; none while the bridge is off.
+    wanted: Option<u16>,
+    /// The device app connected, by the name it gave ("?" until it gives one).
+    connected: Option<String>,
+    /// The device the connected app reads, as it named it: the 3D mouse reader leaves that one alone.
+    device: Option<String>,
+    /// Motion since the egui thread last took it.
+    motion: BridgeMotion,
+    /// Standard views asked for since then.
+    views: Vec<String>,
+}
+
+fn lock(shared: &Mutex<Shared>) -> Option<MutexGuard<'_, Shared>> {
+    shared.lock().ok()
+}
+
+/// A name a device app gave, without control characters and cut to [`MAX_NAME`]; none when empty.
+fn name(value: Option<&Value>) -> Option<String> {
+    let name: String = value?.as_str()?.chars().filter(|c| !c.is_control()).take(MAX_NAME).collect();
+    let name = name.trim();
+    (!name.is_empty()).then(|| name.to_string())
+}
+
+/// A number of a message, finite and in range; none when it isn't one.
+fn number(msg: &Value, key: &str) -> f64 {
+    bridge_step(msg.get(key).and_then(Value::as_f64).unwrap_or(0.0))
+}
+
+/// Takes one line from the device app into `shared`. Lines that aren't a message this version
+/// knows are ignored. Returns whether the view has something new to show.
+fn consume(line: &[u8], mode: &mut Mode, shared: &mut Shared) -> bool {
+    let Ok(msg) = serde_json::from_slice::<Value>(line) else { return false };
+    let add = |shared: &mut Shared, motion: BridgeMotion| {
+        shared.motion = shared.motion.plus(motion);
+        !motion.is_still()
+    };
+    match msg.get("t").and_then(Value::as_str) {
+        Some("axis") => {
+            let (x, y) = (number(&msg, "x"), number(&msg, "y"));
+            let motion = match mode {
+                Mode::Orbit => BridgeMotion { orbit: [x, y], ..Default::default() },
+                Mode::Pan => BridgeMotion { pan: [x, y], ..Default::default() },
+                // Up zooms in, as a zoom drag does.
+                Mode::Zoom => BridgeMotion { zoom: -y / POINTS_PER_ZOOM_STEP, ..Default::default() },
+            };
+            add(shared, motion)
+        }
+        Some("zoom") => add(shared, BridgeMotion { zoom: number(&msg, "d"), ..Default::default() }),
+        Some("mode") => {
+            let on = msg.get("on").and_then(Value::as_bool).unwrap_or(false);
+            *mode = match msg.get("mode").and_then(Value::as_str) {
+                Some("pan") if on => Mode::Pan,
+                Some("zoom") if on => Mode::Zoom,
+                _ => Mode::Orbit,
+            };
+            false
+        }
+        Some("view") => {
+            let view = msg.get("name").and_then(Value::as_str).and_then(|n| BRIDGE_VIEWS.iter().find(|v| **v == n));
+            match view {
+                Some(view) if shared.views.len() < MAX_VIEWS => {
+                    shared.views.push((*view).to_string());
+                    true
+                }
+                _ => false,
+            }
+        }
+        Some("hello") => {
+            shared.connected = name(msg.get("server")).or_else(|| shared.connected.clone());
+            shared.device = name(msg.get("device"));
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Splits what arrives into lines, across reads. A line longer than [`MAX_LINE`] is dropped up to
+/// its newline, so a peer that never sends one can't make the reader hold more than that.
+#[derive(Default)]
+struct Lines {
+    line: Vec<u8>,
+    skipping: bool,
+}
+
+impl Lines {
+    fn feed(&mut self, mut data: &[u8], mut each: impl FnMut(&[u8])) {
+        while !data.is_empty() {
+            let end = data.iter().position(|b| *b == b'\n');
+            let (part, rest) = match end {
+                Some(i) => (data.get(..i).unwrap_or_default(), data.get(i + 1..).unwrap_or_default()),
+                None => (data, &[][..]),
+            };
+            if !self.skipping {
+                let room = (MAX_LINE + 1).saturating_sub(self.line.len());
+                self.line.extend_from_slice(part.get(..room.min(part.len())).unwrap_or_default());
+                if self.line.len() > MAX_LINE {
+                    self.line.clear();
+                    self.skipping = true;
+                }
+            }
+            if end.is_some() {
+                if !self.skipping {
+                    each(self.line.strip_suffix(b"\r").unwrap_or(&self.line));
+                }
+                self.line.clear();
+                self.skipping = false;
+            }
+            data = rest;
+        }
+    }
+}
+
+/// What SolidCraft says first, so the device app knows which program it is driving.
+fn hello() -> Value {
+    json!({"t": "hello", "app": "solidcraft", "version": env!("CARGO_PKG_VERSION")})
+}
+
+/// Reads one connection until the device app closes it, it fails, or the preferences no longer
+/// ask for this port; then forgets what it had.
+fn serve(mut stream: TcpStream, port: u16, ctx: &Context, shared: &Mutex<Shared>) {
+    // Without a read timeout the reader couldn't notice the bridge being switched off.
+    if stream.set_read_timeout(Some(READ_WAKE)).is_err() || writeln!(stream, "{}", hello()).is_err() {
+        return;
+    }
+    let _ = stream.set_nodelay(true);
+    log::info!("navigation bridge: connected to 127.0.0.1:{port}");
+    if let Some(mut shared) = lock(shared) {
+        shared.connected = Some("?".into());
+    }
+    ctx.request_repaint();
+    let (mut lines, mut mode) = (Lines::default(), Mode::default());
+    let mut chunk = [0_u8; 4096];
+    while lock(shared).is_some_and(|shared| shared.wanted == Some(port)) {
+        match stream.read(&mut chunk) {
+            Ok(0) => break,
+            Ok(size) => {
+                let mut news = false;
+                if let Some(mut shared) = lock(shared) {
+                    lines.feed(chunk.get(..size).unwrap_or_default(), |line| news |= consume(line, &mut mode, &mut shared));
+                }
+                if news {
+                    ctx.request_repaint();
+                }
+            }
+            Err(error) if matches!(error.kind(), ErrorKind::WouldBlock | ErrorKind::TimedOut | ErrorKind::Interrupted) => {}
+            Err(error) => {
+                log::info!("navigation bridge: connection lost: {error}");
+                break;
+            }
+        }
+    }
+    if let Some(mut shared) = lock(shared) {
+        *shared = Shared { wanted: shared.wanted, ..Shared::default() };
+    }
+    ctx.request_repaint();
+}
+
+/// Connects to the device app while the preferences ask for it, again whenever it goes away.
+fn reader(ctx: Context, shared: Arc<Mutex<Shared>>) {
+    loop {
+        let Some(port) = lock(&shared).and_then(|shared| shared.wanted) else {
+            std::thread::sleep(READ_WAKE);
+            continue;
+        };
+        if let Ok(stream) = TcpStream::connect_timeout(&SocketAddr::from((Ipv4Addr::LOCALHOST, port)), CONNECT_TIMEOUT) {
+            serve(stream, port, &ctx, &shared);
+        }
+        std::thread::sleep(RETRY_AFTER);
+    }
+}
+
+/// Which 3D mouse the connected device app reads, for the 3D mouse reader to leave alone. Only
+/// the Windows and macOS readers know a device's strings to compare.
+#[derive(Clone)]
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+pub struct Claim(Arc<Mutex<Shared>>);
+
+#[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+impl Claim {
+    /// Whether a device with these manufacturer and product strings is the one the connected
+    /// device app reads (its name appears in one, ignoring case).
+    pub fn claims(&self, strings: &[String]) -> bool {
+        let Some(device) = lock(&self.0).and_then(|shared| shared.device.clone()) else { return false };
+        let device = device.to_lowercase();
+        strings.iter().any(|s| s.to_lowercase().contains(&device))
+    }
+}
+
+pub struct NavBridge {
+    shared: Arc<Mutex<Shared>>,
+}
+
+impl NavBridge {
+    pub fn start(ctx: &Context) -> Self {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let (worker_ctx, worker_state) = (ctx.clone(), Arc::clone(&shared));
+        if let Err(error) = std::thread::Builder::new().name("solidcraft-nav-bridge".into()).spawn(move || reader(worker_ctx, worker_state)) {
+            log::warn!("navigation bridge: reader could not start: {error}");
+        }
+        Self { shared }
+    }
+
+    #[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+    pub fn claim(&self) -> Claim {
+        Claim(Arc::clone(&self.shared))
+    }
+
+    /// Each frame: passes the preferences to the reader, and the motion and views since the last
+    /// frame to the view. Motion that arrived while the window had no focus is dropped with it.
+    pub fn tick(&mut self, app: &mut SolveApp, ctx: &Context) {
+        let wanted = Some(app.preferences.nav_bridge_port).filter(|port| app.preferences.nav_bridge_enabled && *port != 0);
+        let Some((motion, views, connected)) = lock(&self.shared).map(|mut shared| {
+            shared.wanted = wanted;
+            (std::mem::take(&mut shared.motion), std::mem::take(&mut shared.views), shared.connected.clone())
+        }) else {
+            return;
+        };
+        app.space_mouse.bridge = connected.filter(|_| wanted.is_some());
+        if !motion.is_still() || !views.is_empty() {
+            bridge_frame(app, ctx, motion, &views);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{BufRead, BufReader};
+    use std::net::TcpListener;
+    use std::time::Instant;
+
+    fn feed(shared: &mut Shared, mode: &mut Mode, text: &str) -> bool {
+        let mut news = false;
+        Lines::default().feed(text.as_bytes(), |line| news |= consume(line, mode, shared));
+        news
+    }
+
+    #[test]
+    fn axis_motion_orbits_pans_or_zooms_as_the_mode_says() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"axis\",\"x\":3,\"y\":-2}\n{\"t\":\"axis\",\"x\":1.5,\"y\":0}\n"));
+        assert_eq!(shared.motion, BridgeMotion { orbit: [4.5, -2.0], ..Default::default() });
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":true}\n{\"t\":\"axis\",\"x\":5,\"y\":6}\n");
+        assert_eq!(mode, Mode::Pan);
+        assert_eq!(shared.motion.pan, [5.0, 6.0]);
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"zoom\",\"on\":true}\n{\"t\":\"axis\",\"x\":0,\"y\":-16}\n");
+        assert_eq!(shared.motion.zoom, 2.0, "up zooms in, 8 points a step");
+        // Off, whichever mode it names, is back to orbit.
+        feed(&mut shared, &mut mode, "{\"t\":\"mode\",\"mode\":\"pan\",\"on\":false}\n");
+        assert_eq!(mode, Mode::Orbit);
+        // The ring's steps add up with the zoom mode's.
+        feed(&mut shared, &mut mode, "{\"t\":\"zoom\",\"d\":-0.5}\n");
+        assert_eq!(shared.motion.zoom, 1.5);
+    }
+
+    #[test]
+    fn views_are_queued_by_their_known_names_only() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        assert!(feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"iso\"}\n{\"t\":\"view\",\"name\":\"fit\"}\n"));
+        assert!(!feed(&mut shared, &mut mode, "{\"t\":\"view\",\"name\":\"ISO\"}\n{\"t\":\"view\",\"name\":\"../etc\"}\n{\"t\":\"view\"}\n"));
+        assert_eq!(shared.views, ["iso", "fit"]);
+        let flood = "{\"t\":\"view\",\"name\":\"top\"}\n".repeat(100);
+        feed(&mut shared, &mut mode, &flood);
+        assert_eq!(shared.views.len(), MAX_VIEWS);
+    }
+
+    #[test]
+    fn hostile_lines_never_move_the_view_out_of_range() {
+        let (mut shared, mut mode) = (Shared::default(), Mode::default());
+        let lines = [
+            "not json",
+            "{\"t\":\"axis\",\"x\":\"5\",\"y\":null}",
+            "{\"t\":\"axis\",\"x\":1e308,\"y\":-1e308}",
+            "{\"t\":\"axis\",\"x\":1e999}",
+            "{\"t\":\"zoom\",\"d\":[1]}",
+            "{\"t\":42}",
+            "[1,2,3]",
+            "{\"t\":\"mode\",\"mode\":{\"x\":1},\"on\":\"yes\"}",
+            "\u{0}\u{1}\u{2}",
+        ];
+        for line in lines {
+            Lines::default().feed(format!("{line}\n").as_bytes(), |l| {
+                consume(l, &mut mode, &mut shared);
+            });
+        }
+        let limit = solidcraft_ui_egui::space_mouse::BRIDGE_MAX_STEP;
+        let values = shared.motion.orbit.into_iter().chain(shared.motion.pan).chain([shared.motion.zoom]);
+        for value in values {
+            assert!(value.is_finite() && value.abs() <= limit, "{value}");
+        }
+        assert_eq!(mode, Mode::Orbit);
+        // Invalid UTF-8 is no message either.
+        assert!(!consume(&[0xff, 0xfe, b'{', b'}'], &mut mode, &mut shared));
+    }
+
+    #[test]
+    fn lines_split_across_reads_and_long_ones_are_skipped_to_their_end() {
+        let mut got = Vec::new();
+        let mut lines = Lines::default();
+        for part in ["{\"t\":", "\"zoom\"}\r\n{\"a\"", ":1}\n"] {
+            lines.feed(part.as_bytes(), |line| got.push(String::from_utf8_lossy(line).to_string()));
+        }
+        assert_eq!(got, ["{\"t\":\"zoom\"}", "{\"a\":1}"]);
+        got.clear();
+        let long = vec![b'x'; MAX_LINE * 3];
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        lines.feed(&long, |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert!(lines.line.len() <= MAX_LINE + 1, "never holds more than one line");
+        lines.feed(b"tail\nnext\n", |line| got.push(String::from_utf8_lossy(line).to_string()));
+        assert_eq!(got, ["next"], "the long line is dropped to its newline, the next one read");
+    }
+
+    #[test]
+    fn the_device_app_names_itself_and_the_device_it_leaves_alone() {
+        let shared = Arc::new(Mutex::new(Shared::default()));
+        let claim = Claim(Arc::clone(&shared));
+        let strings = ["STMicroelectronics".to_string(), "MAKMOUSE 3D".to_string()];
+        assert!(!claim.claims(&strings), "nothing is claimed before an app says so");
+        let mut mode = Mode::default();
+        if let Ok(mut shared) = shared.lock() {
+            let hello = format!("{{\"t\":\"hello\",\"server\":\"Dev\\u0007App {}\",\"device\":\"makmouse\"}}\n", "x".repeat(200));
+            feed(&mut shared, &mut mode, &hello);
+            assert_eq!(shared.connected.as_deref().map(|n| n.chars().count()), Some(MAX_NAME));
+            assert!(shared.connected.as_deref().is_some_and(|n| n.starts_with("DevApp")));
+        }
+        assert!(claim.claims(&strings), "the name matches ignoring case");
+        assert!(!claim.claims(&["3Dconnexion".to_string(), "SpaceMouse Compact".to_string()]), "another 3D mouse stays the reader's");
+    }
+
+    /// Waits until `check` holds, or fails after a few seconds.
+    fn wait_for(what: &str, mut check: impl FnMut() -> bool) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !check() {
+            assert!(Instant::now() < deadline, "timed out waiting for {what}");
+            std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+
+    #[test]
+    fn a_connection_says_hello_reads_the_stream_and_ends_when_the_bridge_is_switched_off() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (mut server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        let mut hello_line = String::new();
+        BufReader::new(server.try_clone().unwrap()).read_line(&mut hello_line).unwrap();
+        let hello: Value = serde_json::from_str(&hello_line).unwrap();
+        assert_eq!((hello["t"].as_str(), hello["app"].as_str()), (Some("hello"), Some("solidcraft")));
+        server
+            .write_all(b"{\"t\":\"hello\",\"server\":\"MAKMOUSE\",\"device\":\"MAKMOUSE\"}\n{\"t\":\"axis\",\"x\":2,\"y\":1}\n{\"t\":\"view\",\"name\":\"top\"}\n")
+            .unwrap();
+        wait_for("the stream", || shared.lock().is_ok_and(|s| s.motion.orbit == [2.0, 1.0] && s.views == ["top"]));
+        assert_eq!(shared.lock().unwrap().connected.as_deref(), Some("MAKMOUSE"));
+        // Switched off: the connection ends and what it had is forgotten.
+        shared.lock().unwrap().wanted = None;
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert!(after.connected.is_none() && after.device.is_none() && after.motion.is_still() && after.views.is_empty());
+    }
+
+    #[test]
+    fn a_closed_connection_forgets_the_app() {
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let shared = Arc::new(Mutex::new(Shared { wanted: Some(port), ..Default::default() }));
+        let client = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let (server, _) = listener.accept().unwrap();
+        let worker = {
+            let shared = Arc::clone(&shared);
+            std::thread::spawn(move || serve(client, port, &Context::default(), &shared))
+        };
+        wait_for("the connection", || shared.lock().is_ok_and(|s| s.connected.is_some()));
+        drop(server);
+        worker.join().unwrap();
+        let after = shared.lock().unwrap();
+        assert_eq!((after.connected.as_deref(), after.wanted), (None, Some(port)), "still wanted, so the reader connects again");
+    }
+
+    #[test]
+    fn each_frame_hands_the_view_the_motion_and_passes_the_preferences_on() {
+        let mut app = SolveApp::new(solidcraft_engine::Session::default(), solidcraft_ui_egui::Services::default());
+        app.home.open = false;
+        let ctx = Context::default();
+        let _ = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |_| {});
+        let mut bridge = NavBridge { shared: Arc::new(Mutex::new(Shared::default())) };
+        let queue = |bridge: &NavBridge| {
+            let mut shared = bridge.shared.lock().unwrap();
+            shared.connected = Some("MAKMOUSE".into());
+            shared.motion = BridgeMotion { orbit: [10.0, 0.0], ..Default::default() };
+        };
+        // Off (the default): nothing is wanted, nothing reaches the view.
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+        assert!(app.viewport.bridge_motion.is_none() && app.space_mouse.bridge.is_none());
+        // On: the port is passed to the reader and the motion to the view, once.
+        app.preferences.nav_bridge_enabled = true;
+        app.preferences.nav_bridge_port = 9123;
+        queue(&bridge);
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, Some(9123));
+        assert_eq!(app.space_mouse.bridge.as_deref(), Some("MAKMOUSE"));
+        assert_eq!(app.viewport.bridge_motion.map(|m| m.orbit), Some([10.0, 0.0]));
+        assert!(bridge.shared.lock().unwrap().motion.is_still(), "taken, not handed over twice");
+        // Port 0 is no port.
+        app.preferences.nav_bridge_port = 0;
+        bridge.tick(&mut app, &ctx);
+        assert_eq!(bridge.shared.lock().unwrap().wanted, None);
+    }
+}
@@ -528,6 +528,9 @@ struct Candidate<D> {
    device: D,
    layout: Layout,
    ids: (u16, u16),
+    /// The device's manufacturer and product strings ([`device_strings`]).
+    #[cfg_attr(not(any(target_os = "windows", target_os = "macos")), allow(dead_code))]
+    strings: Vec<String>,
 }

 /// Input reports read with a timeout in milliseconds: hidapi's devices, and the tests' simulated
@@ -634,8 +637,15 @@ fn follow<D: ReportSource>(mut candidates: Vec<Candidate<D>>, now: impl Fn() ->
    }
 }

+/// The device's manufacturer and product strings, which say whether a device app has it
+/// ([`crate::nav_bridge::Claim`]). Asked of the opened 3D mouse only.
 #[cfg(any(target_os = "windows", target_os = "macos"))]
-fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
+fn device_strings(device: &hidapi::HidDevice) -> Vec<String> {
+    [device.get_manufacturer_string(), device.get_product_string()].into_iter().filter_map(|s| s.ok().flatten()).collect()
+}
+
+#[cfg(any(target_os = "windows", target_os = "macos"))]
+fn reader(ctx: Context, shared: Arc<Mutex<Reading>>, bridge: crate::nav_bridge::Claim) {
    let Ok(mut api) = hid_api() else {
        log::warn!("3D mouse: HID initialization failed");
        return;
@@ -657,11 +667,17 @@ fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
                // Read when the device was opened, from this device alone.
                let info = device.get_device_info().ok()?;
                let layout = device_layout(&device, info.vendor_id())?;
-                Some(Candidate { device, layout, ids: (info.vendor_id(), info.product_id()) })
+                let strings = device_strings(&device);
+                Some(Candidate { device, layout, ids: (info.vendor_id(), info.product_id()), strings })
            })
            .collect();
+        let names: Vec<_> = open.iter().map(|candidate| (candidate.ids, candidate.strings.clone())).collect();
+        // Whether the device read now is one a device app has: it moves the view over the navigation
+        // bridge, so read here as well the device would move it twice. What was read before ages out.
+        let mut strings: &[String] = &[];
        follow(open, Instant::now, |event| match event {
            Followed::Device(ids, buttons) => {
+                strings = names.iter().find(|(known, _)| *known == ids).map_or(&[][..], |(_, strings)| strings.as_slice());
                connected(&ctx, &shared, Source::Hid(Some(ids)));
                // Taken over from another device: what it reported meanwhile is its baseline.
                if let Some(buttons) = buttons
@@ -670,6 +686,7 @@ fn reader(ctx: Context, shared: Arc<Mutex<Reading>>) {
                    reading.set_buttons(buttons);
                }
            }
+            Followed::Report(..) if bridge.claims(strings) => {}
            Followed::Report(layout, report) => publish(&ctx, &shared, *layout, report),
            Followed::Gone => reset(&ctx, &shared),
        });
@@ -1054,7 +1071,8 @@ pub struct SpaceMouse {
 }

 impl SpaceMouse {
-    pub fn start(ctx: &Context) -> Self {
+    /// Starts the reader. A device that `bridge` says its own app reads is left to that app.
+    pub fn start(ctx: &Context, bridge: crate::nav_bridge::Claim) -> Self {
        let now = Instant::now();
        let shared = Arc::new(Mutex::new(Reading::new(now)));
        let worker_state = Arc::clone(&shared);
@@ -1063,11 +1081,14 @@ impl SpaceMouse {
        let drivers = Arc::new(Drivers::default());
        #[cfg(target_os = "linux")]
        let worker_drivers = Arc::clone(&drivers);
+        // hidraw names no device's strings to compare (`Claim`).
+        #[cfg(target_os = "linux")]
+        let _ = bridge;
        let spawned = std::thread::Builder::new().name("solidcraft-3d-mouse".into()).spawn(move || {
            #[cfg(target_os = "linux")]
            reader(worker_ctx, worker_state, worker_drivers, Machine);
            #[cfg(not(target_os = "linux"))]
-            reader(worker_ctx, worker_state);
+            reader(worker_ctx, worker_state, bridge);
        });
        if let Err(error) = spawned {
            log::warn!("3D mouse: reader could not start: {error}");
@@ -1458,6 +1479,7 @@ mod tests {
                },
                layout,
                ids: (0x256f, *product),
+                strings: Vec::new(),
            })
            .collect();
        let (mut seen, mut read) = (Vec::new(), 0);
@@ -8,8 +8,9 @@
 //!   row the next launch starts in safe mode by itself.
 //! - **Safe mode** (`--safe-mode` or `SOLIDCRAFT_SAFE_MODE=1`): default settings (the saved ones
 //!   are left untouched), no recovery offer, the software renderer and CPU meshing.
-//! - **No usable graphics device**: one retry on the software renderer
-//!   (`SOLIDCRAFT_RENDERER=cpu`), then a message box saying what failed and what to try.
+//! - **A renderer that cannot start**: on Windows, try the remaining graphics APIs in order,
+//!   then the software renderer (`SOLIDCRAFT_RENDERER=cpu`). An explicit `WGPU_BACKEND` fails
+//!   cleanly without switching. Exhausted retries show a message box with the error.

 use std::path::{Path, PathBuf};

@@ -129,6 +130,48 @@ pub fn pick_cpu_adapter(adapters: &[eframe::wgpu::Adapter], surface: Option<&efr
        })
 }

+/// Adapter properties used to choose a card without opening a device.
+#[derive(Clone, Debug)]
+pub struct AdapterChoice {
+    pub name: String,
+    pub compatible: bool,
+}
+
+/// Choose only surface-compatible adapters. Names saved in preferences are exact; the
+/// environment override follows wgpu's case-insensitive substring convention.
+/// No match leaves selection to the normal wgpu request.
+pub fn choose_adapter(adapters: &[AdapterChoice], environment: Option<&str>, preference: Option<&str>) -> Option<usize> {
+    // wgpu's environment helper panics on a missing name; an override must remain recoverable.
+    let compatible = || adapters.iter().enumerate().filter(|(_, a)| a.compatible);
+    if let Some(name) = environment.filter(|s| !s.is_empty()) {
+        let name = name.to_lowercase();
+        if let Some((index, _)) = compatible().find(|(_, a)| a.name.to_lowercase().contains(&name)) {
+            return Some(index);
+        }
+    }
+    if let Some(name) = preference.filter(|s| !s.is_empty())
+        && let Some((index, _)) = compatible().find(|(_, a)| a.name == name)
+    {
+        return Some(index);
+    }
+    None
+}
+
+/// Leave Automatic on wgpu's normal request path; named choices may defer to it too.
+pub fn configure_adapter(setup: &mut eframe::egui_wgpu::WgpuSetupCreateNew, cpu: bool, environment: Option<String>, preference: Option<String>) {
+    if cpu {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(|adapters, surface| pick_cpu_adapter(adapters, surface).map(Some)));
+    } else if environment.as_deref().is_some_and(|s| !s.is_empty()) || preference.as_deref().is_some_and(|s| !s.is_empty()) {
+        setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
+            let choices: Vec<_> = adapters
+                .iter()
+                .map(|a| AdapterChoice { name: a.get_info().name, compatible: surface.is_none_or(|s| a.is_surface_supported(s)) })
+                .collect();
+            Ok(choose_adapter(&choices, environment.as_deref(), preference.as_deref()).and_then(|i| adapters.get(i)).cloned())
+        }));
+    }
+}
+
 /// `WGPU_BACKEND`: when set, wgpu picks the backends from it and the order below is not used.
 pub const WGPU_BACKEND_ENV: &str = "WGPU_BACKEND";

@@ -176,6 +219,34 @@ pub fn choose_backends(
    Some(WINDOWS_ORDER.into_iter().find(|b| has_hardware(*b)).unwrap_or(Backends::DX12))
 }

+/// Internal, process-local retry choice; never written to the graphics preference.
+pub const RETRY_BACKEND_ENV: &str = "SOLIDCRAFT_STARTUP_BACKEND";
+/// Why this launch is using a fallback, carried to the new process for status and Preferences.
+pub const FALLBACK_NOTE_ENV: &str = "SOLIDCRAFT_GRAPHICS_FALLBACK";
+
+/// A handled startup failure tries each remaining Windows API once, then software rendering.
+/// An explicit environment choice is final, including when software rendering was requested.
+pub fn fallback_backend(windows: bool, explicit: bool, cpu: bool, failed: eframe::wgpu::Backends) -> Option<&'static str> {
+    if explicit || cpu {
+        return None;
+    }
+    if windows {
+        let last = WINDOWS_ORDER.iter().rposition(|backend| failed.intersects(*backend));
+        if let Some(next) = last.and_then(|i| WINDOWS_ORDER.get(i + 1)) {
+            return Some(if *next == eframe::wgpu::Backends::VULKAN { "vulkan" } else { "gl" });
+        }
+    }
+    Some("cpu")
+}
+
+/// Keep driver diagnostics on one bounded line, including across the finite retry chain.
+pub fn fallback_note(previous: &str, failed: eframe::wgpu::Backends, next: &str, error: &str) -> String {
+    let previous: String = previous.chars().take(2048).collect();
+    let error: String = error.chars().take(1024).collect();
+    let line = format!("{previous} Graphics fallback: {failed:?} failed ({error}); trying {next}.");
+    line.split_whitespace().collect::<Vec<_>>().join(" ").chars().take(4096).collect()
+}
+
 /// The device feature for a 32-bit float depth buffer with a stencil (reversed depth, #1434).
 pub const FLOAT_DEPTH_STENCIL: eframe::wgpu::Features = eframe::wgpu::Features::DEPTH32FLOAT_STENCIL8;

@@ -249,6 +320,48 @@ pub fn no_window_message(error: &str, settings: Option<&Path>) -> String {
 mod tests {
    use super::*;

+    fn cards() -> Vec<AdapterChoice> {
+        ["Integrated", "Discrete small", "Discrete large"].into_iter().map(|name| AdapterChoice { name: name.into(), compatible: true }).collect()
+    }
+
+    #[test]
+    fn adapter_names_environment_override_and_missing_card_fallback() {
+        let cards = cards();
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some("LARGE"), Some("Discrete small")), Some(2));
+        assert_eq!(choose_adapter(&cards, None, Some("removed")), None);
+        assert_eq!(choose_adapter(&cards, Some("missing"), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, Some(""), Some("Discrete small")), Some(1));
+        assert_eq!(choose_adapter(&cards, None, Some("Discrete")), None, "saved names are exact");
+    }
+
+    #[test]
+    fn automatic_adapter_leaves_selection_to_wgpu() {
+        let mut cards = cards();
+        assert_eq!(choose_adapter(&cards, None, None), None);
+        assert_eq!(choose_adapter(&cards, Some(""), Some("")), None);
+        cards[2].compatible = false;
+        assert_eq!(choose_adapter(&cards, Some("large"), Some("Discrete large")), None);
+        assert_eq!(choose_adapter(&cards, Some("small"), None), Some(1));
+        assert_eq!(choose_adapter(&[], None, None), None);
+    }
+
+    #[test]
+    fn automatic_adapter_preserves_the_previous_request_configuration() {
+        use eframe::egui_wgpu::WgpuSetupCreateNew;
+        let previous = WgpuSetupCreateNew::without_display_handle();
+        for preference in [None, Some(String::new())] {
+            let mut setup = WgpuSetupCreateNew::without_display_handle();
+            configure_adapter(&mut setup, false, None, preference);
+            assert!(setup.native_adapter_selector.is_none(), "Automatic must use the normal wgpu request");
+            assert_eq!(setup.power_preference, previous.power_preference);
+            assert_eq!(setup.instance_descriptor.backends, previous.instance_descriptor.backends);
+        }
+        let mut setup = WgpuSetupCreateNew::without_display_handle();
+        configure_adapter(&mut setup, false, Some("missing".into()), Some("removed".into()));
+        assert!(setup.native_adapter_selector.unwrap()(&[], None).unwrap().is_none(), "missing names must use the normal request too");
+    }
+
    fn scratch(name: &str) -> PathBuf {
        let d = std::env::temp_dir().join(format!("solidcraft-startup-{name}-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&d);
@@ -358,6 +471,42 @@ mod tests {
        assert_eq!(choose_backends(true, false, false, Some(""), probe(&[Backends::GL])), Some(Backends::GL));
    }

+    #[test]
+    fn failed_windows_backends_fall_back_in_order_and_stop_after_software() {
+        use eframe::wgpu::Backends as B;
+        assert_eq!(fallback_backend(true, false, false, B::DX12), Some("vulkan"));
+        assert_eq!(fallback_backend(true, false, false, B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(true, false, false, B::GL), Some("cpu"));
+        assert_eq!(fallback_backend(true, false, true, B::DX12), None);
+        assert_eq!(fallback_backend(true, false, false, B::DX12 | B::VULKAN), Some("gl"));
+        assert_eq!(fallback_backend(false, false, false, B::VULKAN), Some("cpu"));
+        let note = fallback_note("", B::DX12, "vulkan", "egui_pipeline\n0x80070057");
+        assert!(note.contains("egui_pipeline 0x80070057") && note.contains("vulkan") && !note.contains('\n'));
+        let long = fallback_note(&"x".repeat(5000), B::VULKAN, "gl", &"y".repeat(5000));
+        assert!(long.chars().count() <= 4096 && long.ends_with("trying gl."));
+    }
+
+    #[test]
+    fn explicit_backend_failure_never_switches_api_or_retries_software() {
+        use eframe::wgpu::Backends as B;
+        for windows in [false, true] {
+            for cpu in [false, true] {
+                for backend in [B::DX12, B::VULKAN, B::GL, B::all()] {
+                    assert_eq!(fallback_backend(windows, true, cpu, backend), None);
+                    let mut probed = false;
+                    assert_eq!(
+                        choose_backends(windows, true, cpu, Some("vulkan"), |_| {
+                            probed = true;
+                            false
+                        }),
+                        None
+                    );
+                    assert!(!probed);
+                }
+            }
+        }
+    }
+
    #[test]
    fn only_opengl_on_windows_gets_the_system_title_bar() {
        use eframe::wgpu::Backends;
@@ -394,9 +543,16 @@ mod tests {

    #[test]
    fn probing_a_backend_alone_never_panics() {
-        // Whatever this machine has (often nothing): an answer, not a crash.
-        for b in WINDOWS_ORDER {
-            let _ = has_hardware_adapter(b);
+        // Whatever this machine has (often nothing): an answer, not a crash. On Windows the probe
+        // goes the way the app's does, stopping at the first backend with a GPU: a machine with
+        // D3D12 never loads its OpenGL driver into the test process, and AMD's (`atio6axx.dll`)
+        // aborted the process as it exited (#1156).
+        if cfg!(target_os = "windows") {
+            let _ = choose_backends(true, false, false, None, has_hardware_adapter);
+        } else {
+            for b in WINDOWS_ORDER {
+                let _ = has_hardware_adapter(b);
+            }
        }
    }

@@ -409,8 +565,18 @@ mod tests {
    #[test]
    fn the_software_adapter_is_preferred_and_its_absence_is_an_error_not_a_panic() {
        assert!(pick_cpu_adapter(&[], None).unwrap_err().contains("none"));
-        let instance = eframe::wgpu::Instance::new(eframe::wgpu::InstanceDescriptor::new_without_display_handle());
-        let adapters = pollster::block_on(instance.enumerate_adapters(eframe::wgpu::Backends::all()));
+        // The adapters the software renderer chooses among: it starts D3D12 alone on Windows
+        // (WARP), not every backend, so the test doesn't load the OpenGL driver either (#1156).
+        let options = crate::wgpu_options(true, None);
+        let eframe::egui_wgpu::WgpuSetup::CreateNew(setup) = &options.wgpu_setup else { panic!("the software renderer makes its own device") };
+        let backends = setup.instance_descriptor.backends;
+        if cfg!(target_os = "windows") && std::env::var_os(WGPU_BACKEND_ENV).is_none() {
+            assert_eq!(backends, eframe::wgpu::Backends::DX12);
+        }
+        let mut desc = eframe::wgpu::InstanceDescriptor::new_without_display_handle_from_env();
+        desc.backends = backends;
+        let instance = eframe::wgpu::Instance::new(desc);
+        let adapters = pollster::block_on(instance.enumerate_adapters(backends));
        if adapters.is_empty() {
            return;
        }
@@ -25,6 +25,7 @@ assets/
  fonts/{liberation-sans,biz-udp-gothic}/ # unmodified fonts and OFL licences
  locales/{en,de,ja,ko}.json          # shared offline catalogs
  platforms/{macos,linux,windows}/    # bundle, freedesktop and WiX templates
+  platforms/macos/dmg/                # disk image window: layout, dmgbuild settings, background art
  archive/icons/macos-v1/
    source/icon.vectorcraft          # earlier editable work, retained
                                     # redundant historical exports are retired
@@ -75,7 +76,7 @@ The CLI still supports arbitrary PNG/ICO exports with `solidcraft-cli icon`.
 | macOS | Composer master and paired exports; bundle installs `Assets.car` and `SolidCraft.icns` |
 | Windows executable | `solidcraft-executable.ico`: original DIB/mask representations at 16/24/32/48/64/128/256 px |
 | Windows installer | `solidcraft.ico`: PNG representations at 16/20/24/32/40/48/64/128/256 px; `SOLIDCRAFT_ICONS` override retained |
-| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `ai.storyteller.solidcraft` |
+| Linux, Nix, deb/rpm, tar, Flatpak, Snap | Copy canonical hicolor images; icon name stays `io.tangencylabs.solidcraft` |
 | AppImage | Uses the Linux 256 px image and `.DirIcon` alias |
 | FreeBSD | Shares Linux hicolor images and freedesktop metadata |
 | Web | HTML/Trunk and `manifest.webmanifest` stay in `apps/solidcraft-web/`; copies Japanese font/licence to `fonts/`, uses the collected CSS, and copies the Linux 32/256/512 px images to `icons/` for the favicon and installed app |
@@ -0,0 +1,93 @@
+# Render workspace icon drafts
+
+All ids below are **Open** for owner review, except `render_scene` and `render_image`,
+which are existing accepted icons used only as references. No commands, toolbar
+entries, browser selectors or runtime request manifests are changed by this draft set.
+`render_remove_override` is the one remaining alias (of `render_from_material`);
+`render_execute`, `render_environment` and `render_fit_product` now have their own
+masters in `design/svg/model/`. Accepted source masters stay unchanged.
+
+Review with `python3 -B assets/icons/ui/design/tools/icon_status.py --serve`,
+search `render_`, and select Open. See [STYLE_GUIDE.md](STYLE_GUIDE.md) for
+acceptance; drafts do not imply implemented commands.
+
+The finished references in each row were read and previewed in both themes
+before authoring. Draft contact sheets (96, 24 and 16 px, both themes) are local
+review evidence, not shipped assets. The icons are grouped in five families, each
+with one shared design rule.
+
+## Lights
+
+Rule: a slate source glyph with light passive fill, 2.55-unit outlines and a dotted
+accent stem (three dots, 4.25 diameter, 7 units apart) showing the direction.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Light area | `render_light_area` | `box`, `camera` | Slanted flat panel on the canonical axes above the dotted stem. |
+| Light spot | `render_light_spot` | `camera`, `material` | Cone with a curved rim above the dotted stem. |
+| Light point | `render_light_point` | `camera`, `material` | Round source disc with a centre dot above the dotted stem. |
+| Sun | `render_sun` | `sphere`, `camera` | Source disc of the same size with eight short radial rays instead of a stem. |
+| Light by highlight | `render_light_by_highlight` | `sphere`, `material` | Shaded sphere with a ringed highlight target; the dotted stem arrives from above. |
+| Solo light | `render_solo_light` | `fit`, `camera` | Point source and stem inside four corner focus brackets. |
+
+## Looks
+
+Rule: the lit look sphere (top-left highlight, bottom-right shade) plus one cue that
+says what happens to it; receiving bodies stay canonical grey or cube shapes.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Appearance | `render_appearance` | `material`, `box` | Shaded look sphere on the top corner of an accent-shaded cube: a look assigned to a body. |
+| Paint | `render_paint` | `material`, `paste` | Flat brush with an accent tip, light ferrule and slate handle. |
+| Pick up | `render_pick_up` | `material`, `copy` | Eyedropper with a grey bulb, slate crossbar and accent sampling tip. |
+| Replace all | `render_replace_all` | `copy`, `box` | Grey sample sphere with an arrow to an accent sphere, beside a second accent sphere. |
+| Copy look | `render_copy_look` | `material`, `copy` | Look sphere in a square frame, offset from a second frame outline. |
+| Remove override | `render_remove_override` | `appearance`, `box` | Alias of `render_from_material`: the custom look is crossed off. |
+| Same look | `render_same_look` | `select`, `box` | Look sphere and three cubes; the two matching cubes are ringed. |
+| From material | `render_from_material` | `material`, `extrude` | Look sphere struck through above a plain grey slab, so the material shows. |
+
+## Studio
+
+Rule: the standard grey cube stands in the set-up it is lit or placed in.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Library | `render_library` | `library`, `copy` | Row of three look spheres, the middle one accent, on a shelf bar. |
+| Lighting presets | `render_lighting_presets` | `new`, `render_scene` | Two stacked cards, the front one holding a light bulb. |
+| Environment | `render_environment` | `environment_map`, `render_scene` | Dome with a grey cube inside. |
+| Ground | `render_ground` | `box`, `render_scene` | Grey cube on a slab with an accent contact patch. |
+| Backdrop | `render_backdrop` | `render_scene`, `render_image` | Grey cube in front of a tall upright accent panel. |
+
+## Camera and shots
+
+Rule: one chunky camera body with a lower-right round badge for shot actions; the
+other camera icons are simple frames.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Shot | `render_shot` | `camera`, `new` | Camera body with a plus badge: save a shot. |
+| Update shot | `render_update_shot` | `camera`, `undo` | Camera body with a refresh badge. |
+| Render all shots | `render_all_shots` | `copy`, `render_image` | Stacked camera bodies with a play badge. |
+| Shots strip | `render_shots_strip` | `camera`, `copy` | Strip of three small frames, the middle one in accent. |
+| Fit product | `render_fit_product` | `fit`, `camera` | Grey cube inside four corner brackets. |
+| Lens / field of view | `render_lens` | `camera`, `fit` | Concentric lens rings around an accent centre. |
+| Exposure | `render_exposure` | `material`, `environment_map` | Disc split light and accent, with plus and minus marks. |
+| Aspect frame | `render_aspect_frame` | `render_image`, `fit` | Wide rounded frame with two opposite corner brackets. |
+| Frame guides | `render_frame_guides` | `render_image`, `fit` | Rounded frame with a rule-of-thirds grid and four accent nodes. |
+
+## Output and result
+
+Rule: one picture base (frame with landscape) with a lower-right round badge; the
+size, background and quality icons draw their own simple subject.
+
+| Meaning | Id | Finished references | Drawing |
+|---|---|---|---|
+| Render image | `render_execute` | `render_image`, `camera` | Picture with a play badge: create a rendered image. |
+| Render output size | `render_output_size` | `render_image`, `fit` | Picture frame with a diagonal double-headed dimension arrow. |
+| Transparent background | `render_transparent_background` | `material`, `render_image` | Grey cube on a checker tile. |
+| Quality | `render_quality` | `list`, `library` | Three rising bars, the tallest in accent. |
+| Check render | `render_check` | `render_image`, `new` | Picture with a check badge. |
+| Cancel render | `render_cancel` | `render_image`, `delete` | Picture with a square stop badge. |
+| Export image | `render_export_image` | `render_image`, `copy` | Picture with a large outward diagonal arrow at the upper right. |
+| Compare | `render_compare` | `render_image`, `material` | Two grey pictures split by a vertical slider with opposed arrows. |
+| Results | `render_results` | `render_image`, `copy` | Stack of two pictures, the front one showing a landscape. |
@@ -27,6 +27,9 @@ error = { master = "status_error", accent = "surface" }
 warning = { master = "status_warning", accent = "mesh" }
 ground = "c_fix"

+# Visual style: Shaded with edges is the generic style icon.
+style_shaded_edges = "style"
+
 # Same finished drawing, different semantic operation. Colours live only in palette.toml.
 sketch_break = { master = "break", accent = "sketch" }
 sketch_cancel = { master = "close", accent = "sketch" }
@@ -45,3 +48,7 @@ sketch_chamfer_equal = { master = "sketch_chamfer", accent = "sketch" }
 sketch_chamfer_two = { master = "sketch_chamfer_two_distances", accent = "sketch" }
 offset_one_side = { master = "offset", accent = "sketch" }
 bom = "list"
+
+# Render workspace drafts: shared meanings; owner review remains Open.
+# Removing a look override returns the body to its material look.
+render_remove_override = "render_from_material"
@@ -48,6 +48,38 @@ source = "#236ead"
 light = "#236ead"
 dark  = "#2976b8"

+# Simultaneous component colours for inspection icons; existing workspace ramps stay unchanged.
+
+[roles.component-orange-1]
+source = "#f1d2af"
+light = "#f1d2af"
+dark = "#ba8f6a"
+
+[roles.component-orange-2]
+source = "#c06f00"
+light = "#c06f00"
+dark = "#b86f04"
+
+[roles.component-orange-3]
+source = "#a45000"
+light = "#a45000"
+dark = "#95682d"
+
+[roles.component-yellow-1]
+source = "#e5d99b"
+light = "#e5d99b"
+dark = "#a9985f"
+
+[roles.component-yellow-2]
+source = "#a28200"
+light = "#a28200"
+dark = "#9a8100"
+
+[roles.component-yellow-3]
+source = "#826700"
+light = "#826700"
+dark = "#857100"
+
 [strokes]          # on the 64 grid
 geometry = 2.55
 action = 4.25
@@ -1,6 +1,8 @@
 accessibility	false
 activate	false
+agent_chat	false
 align	false
+ambient_occlusion	false
 appearance	false
 arc3	false
 arc_center	false
@@ -57,10 +59,13 @@ circle_tt	false
 circle_ttt	false
 close	false
 coil	false
+colored_components	false
+colored_components_off	false
 combine	false
 compare	false
 component	false
 compute	false
+cone	false
 configuration_table	false
 conic	false
 constrainer	false
@@ -80,6 +85,8 @@ decal	false
 delete	false
 delete_face	false
 dimension	false
+display	false
+dots	false
 draft	false
 draft_analysis	false
 drive	false
@@ -107,7 +114,9 @@ folder	false
 frame_member	false
 gear	false
 graph	false
+grid	false
 ground	false
+ground_shadow	false
 help	false
 hem	false
 hole	false
@@ -207,6 +216,11 @@ section	false
 select	false
 send	false
 settings	false
+settings_keyboard	false
+settings_monitor	false
+settings_mouse	false
+settings_palette	false
+settings_plug	false
 sheet_rules	false
 shell	false
 shield	false
@@ -244,7 +258,13 @@ star	false
 status_error	false
 status_recovery	false
 style	false
+style_hidden_edges	false
+style_shaded	false
+style_shaded_edges	false
+style_translucent	false
+style_wireframe	false
 suppress	false
+surface	false
 surface_blend	false
 surface_boundary	false
 surface_extend	false
@@ -6,6 +6,7 @@
  "agent_chat": "4a9ae0e7e2c360b4858b3175674c93d096705c92318fecd481e849f3ae650bf4",
  "agent_link": "2f20d89a0e3e9b28744910dddf7f282a1099ccd91aa160c9841c5b1d9ea9ed0f",
  "align": "05615db7dd9e4be56ae898e59a68c548b8a8447794442a9a394940651204bc4f",
+  "ambient_occlusion": "973f8ef2326aeaf0face576e5a2c79c7ef3d13638b2c51a5aad199e4ef7edb02",
  "appearance": "b3162edd92291a5ef402e8499cd52be05beb2fa7eda641163c3f6e98325de2bf",
  "arc3": "fdca3d501fd557ac989376a12e9c4fa8231fde2b455c20724d1079a466153e9c",
  "arc_center": "3a5fdeb1d64fc6741f944c4435870b05fccab62293e270da692c6681155cbc51",
@@ -88,6 +89,7 @@
  "dimension": "a926b7c64bc8ca99d8d6dcbb81b95235bd3fc34fbed049aca8b01b4d1147c15d",
  "disclosure_closed": "49a350c6f2efae78de0be96c524ebee1fd1291ea449a84224b88d37164a4e807",
  "disclosure_open": "d13ce3f97e3e362a9904fa2bf3412f3f00e4136bc23538b92d41483961d280de",
+  "display": "58b45e5e2230eaf2c80f74b3be2e02a23714c90d6fb03b59ed093a1949993163",
  "dots": "600f7ff209d93145fc938bc4f6a1e34473e6b9ee22a5b4718f133bc7da5ee58d",
  "draft": "9c0fc361cacd0ad95ccd54794f4825dfc9901a83a3de752a588faec365d0ee09",
  "draft_analysis": "eb39c0f90e9cf226da6307365a76015e900dd692dc3f0fdc8f02fe717226261f",
@@ -101,6 +103,7 @@
  "error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
  "explode": "2aecb05d5f05aff1ab629066cb9bea8718ea213ac70948ef71a3ced3321f4cb2",
  "export": "c8c2abf007e43e896479d78798e3976ba9eda809507c820bb38538f77db696ac",
+  "export_tray": "f18606e1f63726c57a0787dced4fb8a221b4a4fc18b88b0bbdee743e546cb489",
  "extend": "28c63df352c77d02feffe44cf09fb0fc1d48f7905aaabbfa6dba601dbb70f8e8",
  "extrude": "9cc1538971c5d25467aaed23f739899d9d102fd07f86472ac3197c54ca2e1144",
  "eye": "2449167c8410826dc1106b687c12a309d5bea8f7817b897943e80f182a163c2d",
@@ -116,12 +119,15 @@
  "folder": "c19f5230df45a1bda1e92e89de38bba21c91e6eca0517eb15847a7712012d1e5",
  "gear": "25a1ca48a587850da1104a46005a330873ed196246e3d04e12cf61f26ad2b0d5",
  "graph": "7156caedd2dbfa2ae53da18b7a2204b8db66c45126859d36caf049a3fd4335a4",
+  "grid": "084b5040d57e9d5183b3db1fad0d17a13ab5bae64676eef703cc06622f9c7438",
  "ground": "23e2471a9d6872e83028e0e219e330cef1930a4d89456a0fefa1bda8a7e3eb81",
+  "ground_shadow": "a96809ed87f5047c2d7f1274908ed7b65b180613322ac9c10eb0f9d6296c1b66",
  "help": "8ce4060577483dbdb510be147d2827de50ac20029354008fca55abc0c7edf05d",
  "hem": "f9b1aafbedcf3dc90c26be308814638e0095fbe31b0647092507343fa60af011",
  "hole": "f82d47751f826e08682db847a270897474661bfe9f35b6d3678f49a203172563",
  "home": "ab5f1c41d377687e4c5a808dfdccf2757b33dd43f934d44df43d6e9118176853",
  "import": "e343540eb49fdb1e53c4d54b9e60ae513b3103df6c9133048bed878e58067455",
+  "import_tray": "c6aec9556dc8ecb6c953d6bf1f384f220c68167a92e444950c24ded81f66a0b6",
  "include": "f5b80ad3e06e3b863fcfbe415ec912e4e09653dd519f9ac207819339fe34730f",
  "infinite": "53fb781131078d2f8e71be23aa610d9f9d9c8bb79ba5f97fa397475e9ff8c3bd",
  "inspect": "d2b4644b2d5f1aa50cb576b9265e275fa91201e296c2bc79865f810067d538e9",
@@ -206,8 +212,45 @@
  "redo": "28e925493fa9e5f52e2c8e3beeb288af13fdb4f85f3cd92270096a10561e7a1a",
  "refold": "1fa6a8604af7d04c01bc31d0e5875eb2cc91f5fa6bfc5491dd6680d3299eb26f",
  "rename": "6887c5467101dca1d213154020d3b03be9b2704ac310de9d0a8ebde62c013bf5",
+  "render_all_shots": "9c04f49624cc2685472041cb3f3e95da2c5f32deeebb9723f4a8e3c369680a5b",
+  "render_appearance": "53287b30915a266d8a3858d5bef24b93ed11f8d612c20c445d3032f400a925cc",
+  "render_aspect_frame": "5d74b263eeb03eb0494b3774817135b8f119caff205a8b31c480d7dd0e5a8554",
+  "render_backdrop": "d27f7d6da7a31c5944dd0ff67c21838690f000f2d87b0bf5274bef0744de34ce",
+  "render_cancel": "2f1d8b3039007ccfc224390758e05d6202fa2eabf63724c744217dcab5d58e5e",
+  "render_check": "65ccf0407d80937c6931cbf87b6d0e628cfb62ca3e841483d02dd9de19c3717c",
+  "render_compare": "1b2d3f3920782490b96b4d14a7cc9506eff98ff2efae00f86d911fabcabc7cb0",
+  "render_copy_look": "25e9138a839a7e6b8225b48cd2f36daba42a928eff541fe616f3df39a1bc82b7",
+  "render_environment": "50cb18380d9310f6e04084c24ac85529599966b1d90c6bef514f4e63f9b30854",
+  "render_execute": "e4d9a66f4569e00c4b4b2ac05a80a9f3eba4e59802c62d3af5bb951ba9153cbf",
+  "render_export_image": "2456f55fa3b50ab84ae871963d4a6b6e92f486cf6ed3039f3a2f07f11192a655",
+  "render_exposure": "60eb5fa040aefe872ab2de66099493513a494ab758a23d443753d033eaf3a05d",
+  "render_fit_product": "8e58b293a39a06fca4cda0543adc2afef3d0041fe34b0bc0c800afb2d5635123",
+  "render_frame_guides": "cb1df01051de42047e38de9dd2a96fcb5b67bd5979cb5756412890400b69e5bc",
+  "render_from_material": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_ground": "2b900b433870cbc4bd0282e54c604ec696aa28354c753a13b09806f5e87d99c3",
  "render_image": "e3dd622591de4fdc211f9bd3c6dcb54b01a308e8bcebd02bb80dd6b3982ce2a5",
+  "render_lens": "79bb615d46a05ea5ffc9e2e905cc25f266b3b7e761c160f7d25bbdb3dea0a430",
+  "render_library": "828af74034a62616c774ab0cbe70b7cf9fd42778b574febfb1812f8aa17fd49b",
+  "render_light_area": "b1f3ee596ee1d35f6e8444b54e94f36a34c2129697c88e5286dbf38565f50816",
+  "render_light_by_highlight": "5b37c8c6aa27ac2002dd8c8094e415c64e9eb315a55c4f146e328314e8f639a2",
+  "render_light_point": "a602cb5fa26f04f1bb9be7c14e5a9a9ce52b37550dfd3211a55e915f941f5803",
+  "render_light_spot": "a9413de906266bec0165b4cb06ecac8e36dce0b6ddec4bc4cc6ff4f152601483",
+  "render_lighting_presets": "e0a08433f548a9dd139296107b04b1d4c57ff04303c9bee32d896e2ea06a8d07",
+  "render_output_size": "f08fe354e4d5a6dd21af29cb077ceed96c413c68f48d9f72548ae1614337f88b",
+  "render_paint": "e3d3202205a5a90906348cae519340d38f475e42039a7f60c835cf7a21081da1",
+  "render_pick_up": "df67d10f333a3c9e367897d599a4be510f10ed36c24763c26817f22d24ff35b7",
+  "render_quality": "28fe44cdd2b2f58b91d91dcf20a6dfbd22cf3db6008e1db179717523ecc4889e",
+  "render_remove_override": "c928daa803a28f90ce24096731b8de711c6cd3215259ac9cd761b6be2e1b9618",
+  "render_replace_all": "3bbf830619a91be186b9dc91726b8e47c293556d2ac8c93d87c71014c9f3abcd",
+  "render_results": "94e78898d88eef415e56ca5ec1e056089a2a5aa709abc69e5b8103d6096a019c",
+  "render_same_look": "2b5c69c523a1c949c22638c378803e77123095fddd36cfa58e94b2fd91ca61d7",
  "render_scene": "1c4d7350f6f17ad637a7d633cb65a64c298af20321b1dbdac01b51d47a0e2822",
+  "render_shot": "4428080faa94f276c8a1d20eb38d04835ee5ae9d6337402371a5edf09f97ddc5",
+  "render_shots_strip": "1dcf5cc8e704691985284e0ca06e03b22540ea9d4cd23f4fb8675801ae7e69ec",
+  "render_solo_light": "abb9f8993be108a79d491bfaca32cde59d07a69db3ead58195e8ca0d8e8d909b",
+  "render_sun": "d86b51f3d4d83df4e932a22bb20d567513529a2eaaa42b93f744412eed2be901",
+  "render_transparent_background": "71dab4763516053734d4eec964b0899716d617597fe0d09e3bfa0cc36224dd7a",
+  "render_update_shot": "22d82ad332f8325395596c4bec4c1ec9bbb72d9fc4cd62ad658a93d7f5f803b9",
  "reorder": "c45755c8f23575415397bffb316eed9f2d8c014f451ab6f8c3123aca1a99b675",
  "replace_face": "fcee556c684a1138a30a2574ea565c98ff29f9368c2e861d0fb861155a57d28b",
  "rest": "eab64961b5340bdbbd92affe0c9b8477dc297a3b49e05e39d5fa71c0f2fda66c",
@@ -224,10 +267,23 @@
  "screw": "5e30570785360d6a591ea22862a82f1cf62228385c1e96382536db8a453ac791",
  "section": "cdd13f99f15f6d59bfa21c747810608d6afd00cb8207faf0337928c8521e7eae",
  "select": "fdf6431270006ca7409c60c37cfed59572de04229f104ec723e6010ffa2b7163",
+  "select_bodies": "8e6e61e083e6097535da3b98d41b607b40fc81b72bbd8c7fb903618c5b35c568",
+  "select_components": "3e6cc847b334e92ce7ec5e5f35dfa929572e0974239790d76563ca4e20b26789",
+  "select_faces_edges": "7b99b5370b1647bf8cea57df7a1053caab641c2f4a94c4d797b9679e6f38d6f1",
+  "select_features": "b050bc19ce86d135cbe50998be681555110e92e179c4c7b101170c6b62c19943",
+  "select_parts": "569adc5595a64187411d8ffeea69eab3b76ddfa33aeead6fd728efdd993bcccc",
+  "select_sketch": "b0605b34a14d4173f7ed80d877109ec0b891a1b395bcab5743a603ed2eae240a",
+  "send": "f83b6cdab792f9567a81d46d7828ed20795513c57a2c7d00fbbe6bd14d2f5848",
  "settings": "9193dd3a1007c43660d0d47b6499cb2571338b67949e1a99df112057b9bf2b8a",
+  "settings_keyboard": "4968c70788094365af9c6e2b1c15b2aac45cf21212a14b8a256daf1ffe17f41a",
+  "settings_monitor": "6fcea26e2fc1673c76c6e7fadac4a91812ed43250cfb363c4f40c0cacfbd7aa5",
+  "settings_mouse": "47754752ea6fb37ec9686c0460740935a4db30fb267f1136a9246aec9a17b3f1",
+  "settings_palette": "a060015a750ff4367c65c04b83bf43720e13a38d8dee35330e1d8880f89eaa22",
+  "settings_plug": "79c00b84b2d1d28e3bf6096639c75476b7e1ee0a326c34ad76a79ad866c0102e",
  "sheet": "774e30923ef6f37dd9c0b2bc3e45705e83b3a76700bf071cd41155a365d0daa4",
  "sheet_rules": "5d3a2f37d3b4a4262b3ddbdae53d61f29e0f8e284dd54006da25a7acebfa1114",
  "shell": "a1959ea0d0441a479bf654b6e549e2e44a0bfdc9cda4eb46fe1fbfd884de7e38",
+  "shield": "5e2d2d157309e0daa72f7c53073dfdb0a474def972a041cd172567f1d1e485ec",
  "silhouette": "2a848aed2f247b1c0439f830a34a513c93bc5493c40044c821d493d863ad996e",
  "sketch": "b52e5862b1709a9a7e3ca00d7436d126fbfc01b38080006fa4e17dc581dfa103",
  "sketch_break": "67a5fab332616e6d6a9aeae3bedc04ee0768179143ba34b795bdd98cea04bb24",
@@ -261,7 +317,13 @@
  "status_error": "b7188fcdfadf1512ddd2896805a14618179789f87047b219560a7dab74bd360f",
  "status_warning": "1ac4f0ccfac2c01f6f66cb42188f9ae053c4aef9c5bbd249f1fb09611eb4d825",
  "stitch": "6c3205d64007b771ed78d6f8055867578439fb25d591563b32dbd3343c98732d",
+  "stop": "36967eb4d423370d0d6c679b0a71f8d09f4fb2c73eed3e8cc50c604c44b0c32b",
  "style": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
+  "style_hidden_edges": "a707dfc0bdcabe9144865f569abfcb478e493143cbd4331efc1404cf3082f6d2",
+  "style_shaded": "6e5f8f9a9030ab3717f8b2192bbfd3f6b515ad398acf6cb41bc24f1298bc73b4",
+  "style_shaded_edges": "6c2b04234b82ea4858c80190cc7208c60f549358253005afc35ab4e29506b578",
+  "style_translucent": "c46b0cd485cfb9023514908357048b5cba9017a0c4976239da1e98f50e4ab5f9",
+  "style_wireframe": "af7e575d378b5b6850bee9d3ca384efab95c8d4c876c5e3524f3ea771c4380a3",
  "suppress": "c54fbc01c12c0175d78cd63f692e8aaf73fc2cac79752b2a3ad821ac32734343",
  "surface": "ba0e839ce0ee03e7ff95a2389a5ecb20bd80c713064d9b1bd5f461f4a80d1921",
  "surface_blend": "0642f3b4af7d22f379a3c74f54c7b1c9eef0bdda19372ce4df73c0e56bdd7bbc",
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Ambient occlusion</title>
+  <g opacity="0.22"><path d="M13 51L51 51A38 38 0 0 0 13 13Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.38"><path d="M13 51L40 51A27 27 0 0 0 13 24Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.62"><path d="M13 51L29 51A16 16 0 0 0 13 35Z" fill="currentColor" stroke="currentColor" stroke-width="0" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M13 10L13 51L54 51" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Display</title>
+  <path d="M10 22L54 22M10 42L54 42" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="24" cy="22" r="10.5" fill="#ffffff"/>
+  <circle cx="42" cy="42" r="10.5" fill="#ffffff"/>
+  <circle cx="24" cy="22" r="6.4" fill="currentColor"/>
+  <circle cx="42" cy="42" r="6.4" fill="currentColor"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Grid</title>
+  <path d="M12 12L52 12L52 52L12 52Z" fill="none" stroke="currentColor" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M25.3 12L25.3 52M38.7 12L38.7 52M12 25.3L52 25.3M12 38.7L52 38.7" fill="none" stroke="currentColor" stroke-width="4" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Ground shadow</title>
+  <path d="M32 4.8 L48.1 13.9 L48.1 32.1 L32 41.2 L15.9 32.1 L15.9 13.9Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M9.34 31.35A25 11 0 1 0 54.66 31.35" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Bodies</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Components</title>
+  <path d="M22.91 5.75 L41.09 16.25 L22.91 26.75 L4.72 16.25ZM4.72 16.25 L22.91 26.75 L22.91 47.75 L4.72 37.25ZM41.09 16.25 L59.28 26.75 L41.09 37.25 L22.91 26.75ZM22.91 26.75 L41.09 37.25 L41.09 58.25 L22.91 47.75ZM59.28 26.75 L41.09 37.25 L41.09 58.25 L59.28 47.75Z" fill="currentColor" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M37.46 18.35L22.91 26.75L22.91 43.55" fill="none" stroke="#ffffff" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Faces and edges</title>
+  <path d="M32 6 L55 19 L32 32 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="4.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L9 19M32 32L55 19M32 32L32 58" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Features</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="4.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M9 19L32 32M32 32L55 19M32 32L32 58" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M42 19C42 22.2 37.52 24.8 32 24.8C26.48 24.8 22 22.2 22 19C22 15.8 26.48 13.2 32 13.2C37.52 13.2 42 15.8 42 19Z" fill="currentColor" stroke="currentColor" stroke-width="0.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Parts</title>
+  <path d="M22.91 5.75 L41.09 16.25 L22.91 26.75 L4.72 16.25ZM4.72 16.25 L22.91 26.75 L22.91 47.75 L4.72 37.25Z" fill="none" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M41.09 16.25 L59.28 26.75 L41.09 37.25 L22.91 26.75ZM22.91 26.75 L41.09 37.25 L41.09 58.25 L22.91 47.75ZM59.28 26.75 L41.09 37.25 L41.09 58.25 L59.28 47.75Z" fill="currentColor" stroke="currentColor" stroke-width="4.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Sketch features</title>
+  <path d="M10 46C18 14 46 14 54 46" fill="none" stroke="currentColor" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="10" cy="46" r="8.6" fill="#ffffff"/>
+  <circle cx="54" cy="46" r="8.6" fill="#ffffff"/>
+  <circle cx="32" cy="22.5" r="8.6" fill="#ffffff"/>
+  <circle cx="10" cy="46" r="5.8" fill="currentColor"/>
+  <circle cx="54" cy="46" r="5.8" fill="currentColor"/>
+  <circle cx="32" cy="22.5" r="5.8" fill="currentColor"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Shaded with hidden edges</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L15.44 22.64M32 32L48.56 22.64M32 32L32 50.72" fill="none" stroke="#ffffff" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L32 13.28M32 32L48.56 41.36M32 32L15.44 41.36" fill="none" stroke="#ffffff" stroke-width="3.2" stroke-linejoin="round" stroke-linecap="round" stroke-dasharray="4.5 4"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Shaded</title>
+  <g opacity="0.5"><path d="M32 6 L55 19 L32 32 L9 19Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <g opacity="0.8"><path d="M9 19 L32 32 L32 58 L9 45Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M32 32 L55 19 L55 45 L32 58Z" fill="currentColor" stroke="currentColor" stroke-width="0.8" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Translucent</title>
+  <defs>
+    <clipPath id="tr-clip"><path d="M32 8.6 L52.7 20.3 L52.7 43.7 L32 55.4 L11.3 43.7 L11.3 20.3Z"/></clipPath>
+  </defs>
+  <g clip-path="url(#tr-clip)"><path d="M-71 72L9 -8M-60.5 72L19.5 -8M-50 72L30 -8M-39.5 72L40.5 -8M-29 72L51 -8M-18.5 72L61.5 -8M-8 72L72 -8M2.5 72L82.5 -8M13 72L93 -8M23.5 72L103.5 -8M34 72L114 -8M44.5 72L124.5 -8M55 72L135 -8" fill="none" stroke="currentColor" stroke-width="2.8" stroke-linejoin="round" stroke-linecap="round"/></g>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L11.76 20.56M32 32L52.24 20.56M32 32L32 54.88" fill="none" stroke="#ffffff" stroke-width="6.4" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L11.3 20.3M32 32L52.7 20.3M32 32L32 55.4" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Wireframe</title>
+  <path d="M32 6 L55 19 L55 45 L32 58 L9 45 L9 19Z" fill="none" stroke="currentColor" stroke-width="5.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L32 6M32 32L55 19M32 32L55 45M32 32L32 58M32 32L9 45M32 32L9 19" fill="none" stroke="currentColor" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Colored components</title>
+  <path d="M9.235 17.706L15.059 20.882L15.059 48.941L9.235 44.926Z" fill="#c06f00"/>
+  <path d="M35.176 9.235L15.059 20.882L15.059 48.941L36.765 35.139Z" fill="#a45000"/>
+  <path d="M29.046 5L35.176 8.176L15.196 19.718L9.066 16.541Z" fill="#f1d2af"/>
+  <path d="M29.046 5.529L35.176 8.706L35.176 36.235L15.059 49.471L9.235 45.765L9.066 17.071Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9.066 17.6L15.059 20.882L34.647 9.235" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M15.059 20.882L15.059 47.067" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L44.949 51.122L32.222 43.774Z" fill="#328bd3"/>
+  <path d="M54.934 20.173L44.949 25.944L44.949 51.122L54.934 45.352Z" fill="#236ead"/>
+  <path d="M42.059 12.412L54.934 20.173L44.949 25.944L32 17.706Z" fill="#b9ddf8"/>
+  <path d="M41.159 11.766L54.934 20.173L54.934 45.352L44.949 51.122L31.164 42.715L31.164 17.536Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L54.934 20.173" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M44.949 25.944L44.949 51.122" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L31.015 59L18.299 51.652Z" fill="#a28200"/>
+  <path d="M41.921 40.121L31.015 46.411L31.015 59L41.921 52.711Z" fill="#826700"/>
+  <path d="M29.194 32.773L41.921 40.121L31.015 46.411L18.299 39.062Z" fill="#e5d99b"/>
+  <path d="M29.194 32.773L41.921 40.121L41.921 52.711L31.015 59L18.299 51.652L18.299 39.062Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L41.921 40.121" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M31.015 46.411L31.015 59" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Disable component colors</title>
+  <path d="M9.235 17.706L15.059 20.882L15.059 48.941L9.235 44.926Z" fill="#328bd3"/>
+  <path d="M35.176 9.235L15.059 20.882L15.059 48.941L36.765 35.139Z" fill="#236ead"/>
+  <path d="M29.046 5L35.176 8.176L15.196 19.718L9.066 16.541Z" fill="#b9ddf8"/>
+  <path d="M29.046 5.529L35.176 8.706L35.176 36.235L15.059 49.471L9.235 45.765L9.066 17.071Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9.066 17.6L15.059 20.882L34.647 9.235" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M15.059 20.882L15.059 47.067" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L44.949 51.122L32.222 43.774Z" fill="#328bd3"/>
+  <path d="M54.934 20.173L44.949 25.944L44.949 51.122L54.934 45.352Z" fill="#236ead"/>
+  <path d="M42.059 12.412L54.934 20.173L44.949 25.944L32 17.706Z" fill="#b9ddf8"/>
+  <path d="M41.159 11.766L54.934 20.173L54.934 45.352L44.949 51.122L31.164 42.715L31.164 17.536Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M32.222 18.595L44.949 25.944L54.934 20.173" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M44.949 25.944L44.949 51.122" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L31.015 59L18.299 51.652Z" fill="#328bd3"/>
+  <path d="M41.921 40.121L31.015 46.411L31.015 59L41.921 52.711Z" fill="#236ead"/>
+  <path d="M29.194 32.773L41.921 40.121L31.015 46.411L18.299 39.062Z" fill="#b9ddf8"/>
+  <path d="M29.194 32.773L41.921 40.121L41.921 52.711L31.015 59L18.299 51.652L18.299 39.062Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M18.299 39.062L31.015 46.411L41.921 40.121" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M31.015 46.411L31.015 59" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Cone</title>
+  <path d="M32 5L12.7 45.97A20 11.55 0 1 0 51.3 45.97Z" fill="#328bd3"/>
+  <path d="M32 5L39 59.82A20 11.55 0 0 0 51.3 45.97Z" fill="#236ead"/>
+  <path d="M32 5L12.7 45.97A20 11.55 0 1 0 51.3 45.97Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Render all shots — every saved camera view at once</title>
+  <path d="M27.1 12L29.26 12L31.42 6.96Q31.85 5.52 33.22 5.52L36.82 5.52Q38.19 5.52 38.62 6.96L40.78 12L51.58 12Q55.18 12 55.18 15.6L55.18 31.44Q55.18 35.04 51.58 35.04L27.1 35.04Q23.5 35.04 23.5 31.44L23.5 15.6Q23.5 12 27.1 12Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M16.6 21L18.76 21L20.92 15.96Q21.35 14.52 22.72 14.52L26.32 14.52Q27.69 14.52 28.12 15.96L30.28 21L41.08 21Q44.68 21 44.68 24.6L44.68 40.44Q44.68 44.04 41.08 44.04L16.6 44.04Q13 44.04 13 40.44L13 24.6Q13 21 16.6 21Z" fill="#b8c3cf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M6.1 30L8.26 30L10.42 24.96Q10.85 23.52 12.22 23.52L15.82 23.52Q17.19 23.52 17.62 24.96L19.78 30L30.58 30Q34.18 30 34.18 33.6L34.18 49.44Q34.18 53.04 30.58 53.04L6.1 53.04Q2.5 53.04 2.5 49.44L2.5 33.6Q2.5 30 6.1 30Z" fill="#b8c3cf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="18.34" cy="41.52" r="7.56" fill="#b9ddf8" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="47.5" cy="47.5" r="14" fill="#ffffff"/>
+  <circle cx="47.5" cy="47.5" r="12" fill="#236ead"/>
+  <path d="M43.9 41.7L53.3 47.5L43.9 53.3Z" fill="#ffffff" stroke="#ffffff" stroke-width="1.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Appearance — a body wearing the look sphere</title>
+  <path d="M17.33 24.8L38.98 37.3L38.98 62.3L17.33 49.8Z" fill="#328bd3"/>
+  <path d="M60.63 24.8L38.98 37.3L38.98 62.3L60.63 49.8Z" fill="#236ead"/>
+  <path d="M38.98 12.3L60.63 24.8L38.98 37.3L17.33 24.8Z" fill="#b9ddf8"/>
+  <path d="M38.98 12.3L60.63 24.8L60.63 49.8L38.98 62.3L17.33 49.8L17.33 24.8Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M17.33 24.8L38.98 37.3L60.63 24.8" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M38.98 37.3L38.98 62.3" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="18.98" cy="17.3" r="16.88" fill="#ffffff"/>
+  <circle cx="18.98" cy="17.3" r="14" fill="#328bd3"/>
+  <path d="M32.14 12.51A14 14 0 0 1 14.19 30.46A18.31 18.31 0 0 0 32.14 12.51Z" fill="#236ead"/>
+  <circle cx="14.22" cy="12.54" r="3.78" fill="#b9ddf8"/>
+  <circle cx="18.98" cy="17.3" r="14" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Aspect frame — the shape of the picture</title>
+  <path d="M13 17L51 17A4 4 0 0 1 55 21L55 43A4 4 0 0 1 51 47L13 47A4 4 0 0 1 9 43L9 21A4 4 0 0 1 13 17Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M4.5 23.5L4.5 12.5L15.5 12.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M59.5 40.5L59.5 51.5L48.5 51.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Backdrop — the coloured wall behind the product</title>
+  <path d="M30.69 4L54.25 17.6L54.25 41.6L30.69 28Z" fill="#328bd3" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.91 29.2L30 35.6L30 48.4L18.91 42Z" fill="#b8c3cf"/>
+  <path d="M41.09 29.2L30 35.6L30 48.4L41.09 42Z" fill="#8e9faf"/>
+  <path d="M30 22.8L41.09 29.2L30 35.6L18.91 29.2Z" fill="#e2e8ef"/>
+  <path d="M30 22.8L41.09 29.2L41.09 42L30 48.4L18.91 42L18.91 29.2Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.91 29.2L30 35.6L41.09 29.2" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M30 35.6L30 48.4" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Cancel render — stop the running render</title>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="#e2e8ef"/>
+  <defs><clipPath id="pic1"><path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#pic1)">
+  <path d="M4 40.8L17.8 27.12L30.68 38.64L38.04 32.88L50 42.96L50 48L4 48Z" fill="#8e9faf"/>
+  </g>
+  <circle cx="36.2" cy="22.8" r="4.2" fill="#8e9faf"/>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="47.5" cy="47.5" r="14" fill="#ffffff"/>
+  <circle cx="47.5" cy="47.5" r="12" fill="#236ead"/>
+  <path d="M44.1 42.9L50.9 42.9A1.2 1.2 0 0 1 52.1 44.1L52.1 50.9A1.2 1.2 0 0 1 50.9 52.1L44.1 52.1A1.2 1.2 0 0 1 42.9 50.9L42.9 44.1A1.2 1.2 0 0 1 44.1 42.9Z" fill="#ffffff" stroke="#ffffff" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Check render — verify the request is ready, without rendering</title>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="#e2e8ef"/>
+  <defs><clipPath id="pic1"><path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#pic1)">
+  <path d="M4 40.8L17.8 27.12L30.68 38.64L38.04 32.88L50 42.96L50 48L4 48Z" fill="#8e9faf"/>
+  </g>
+  <circle cx="36.2" cy="22.8" r="4.2" fill="#8e9faf"/>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="47.5" cy="47.5" r="14" fill="#ffffff"/>
+  <circle cx="47.5" cy="47.5" r="12" fill="#236ead"/>
+  <path d="M41.9 47.7L45.9 51.9L53.3 43.1" fill="none" stroke="#ffffff" stroke-width="3.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Compare — live preview and render side by side</title>
+  <path d="M9 12L55 12A5 5 0 0 1 60 17L60 47A5 5 0 0 1 55 52L9 52A5 5 0 0 1 4 47L4 17A5 5 0 0 1 9 12Z" fill="#e2e8ef"/>
+  <defs><clipPath id="cmpL"><path d="M4 12L32 12L32 52L4 52Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#cmpL)">
+  <path d="M9 12L55 12A5 5 0 0 1 60 17L60 47A5 5 0 0 1 55 52L9 52A5 5 0 0 1 4 47L4 17A5 5 0 0 1 9 12Z" fill="#b8c3cf"/>
+  </g>
+  <defs><clipPath id="cmp"><path d="M9 12L55 12A5 5 0 0 1 60 17L60 47A5 5 0 0 1 55 52L9 52A5 5 0 0 1 4 47L4 17A5 5 0 0 1 9 12Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#cmp)">
+  <path d="M4 44L20.8 28.8L36.48 41.6L45.44 35.2L60 46.4L60 52L4 52Z" fill="#8e9faf"/>
+  </g>
+  <path d="M9 12L55 12A5 5 0 0 1 60 17L60 47A5 5 0 0 1 55 52L9 52A5 5 0 0 1 4 47L4 17A5 5 0 0 1 9 12Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 5L32 59" fill="none" stroke="#ffffff" stroke-width="8.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="32" r="14.5" fill="#ffffff"/>
+  <path d="M32 5L32 59" fill="none" stroke="#236ead" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="32" r="12.8" fill="#236ead"/>
+  <path d="M23.4 32L29.8 25.6L29.8 38.4Z" fill="#ffffff" stroke="#ffffff" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M40.6 32L34.2 25.6L34.2 38.4Z" fill="#ffffff" stroke="#ffffff" stroke-width="1.2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Copy Look — the look in front of a copy outline</title>
+  <path d="M8 40L8 12.5A4.5 4.5 0 0 1 12.5 8L40 8" fill="none" stroke="currentColor" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M24 19L51 19A5 5 0 0 1 56 24L56 51A5 5 0 0 1 51 56L24 56A5 5 0 0 1 19 51L19 24A5 5 0 0 1 24 19Z" fill="none" stroke="currentColor" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="37.5" cy="37.5" r="12" fill="#328bd3"/>
+  <path d="M48.78 33.4A12 12 0 0 1 33.4 48.78A15.69 15.69 0 0 0 48.78 33.4Z" fill="#236ead"/>
+  <circle cx="33.42" cy="33.42" r="3.24" fill="#b9ddf8"/>
+  <circle cx="37.5" cy="37.5" r="12" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Environment — a sky dome lighting the product</title>
+  <path d="M4.04 42A25.96 25.96 0 0 1 55.96 42A25.96 14.99 0 0 1 4.04 42Z" fill="#b9ddf8" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.91 29.2L30 35.6L30 48.4L18.91 42Z" fill="#b8c3cf"/>
+  <path d="M41.09 29.2L30 35.6L30 48.4L41.09 42Z" fill="#8e9faf"/>
+  <path d="M30 22.8L41.09 29.2L30 35.6L18.91 29.2Z" fill="#e2e8ef"/>
+  <path d="M30 22.8L41.09 29.2L41.09 42L30 48.4L18.91 42L18.91 29.2Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.91 29.2L30 35.6L41.09 29.2" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M30 35.6L30 48.4" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Render image — start rendering the picture</title>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="#e2e8ef"/>
+  <defs><clipPath id="pic1"><path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#pic1)">
+  <path d="M4 40.8L17.8 27.12L30.68 38.64L38.04 32.88L50 42.96L50 48L4 48Z" fill="#328bd3"/>
+  </g>
+  <path d="M9 12L45 12A5 5 0 0 1 50 17L50 43A5 5 0 0 1 45 48L9 48A5 5 0 0 1 4 43L4 17A5 5 0 0 1 9 12Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="47.5" cy="47.5" r="14" fill="#ffffff"/>
+  <circle cx="47.5" cy="47.5" r="12" fill="#236ead"/>
+  <path d="M43.9 41.7L53.3 47.5L43.9 53.3Z" fill="#ffffff" stroke="#ffffff" stroke-width="1.6" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Export image — save the finished picture as a PNG file</title>
+  <path d="M9 18L43 18A5 5 0 0 1 48 23L48 49A5 5 0 0 1 43 54L9 54A5 5 0 0 1 4 49L4 23A5 5 0 0 1 9 18Z" fill="#e2e8ef"/>
+  <defs><clipPath id="pic1"><path d="M9 18L43 18A5 5 0 0 1 48 23L48 49A5 5 0 0 1 43 54L9 54A5 5 0 0 1 4 49L4 23A5 5 0 0 1 9 18Z" fill="none"/></clipPath></defs>
+  <g clip-path="url(#pic1)">
+  <path d="M4 46.8L17.2 33.12L29.52 44.64L36.56 38.88L48 48.96L48 54L4 54Z" fill="#8e9faf"/>
+  </g>
+  <path d="M9 18L43 18A5 5 0 0 1 48 23L48 49A5 5 0 0 1 43 54L9 54A5 5 0 0 1 4 49L4 23A5 5 0 0 1 9 18Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M28 36L47.77 17.55" fill="none" stroke="#ffffff" stroke-width="11.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M58 8L53.52 25.18L40.55 11.29Z" fill="#ffffff" stroke="#ffffff" stroke-width="6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M28 36L47.77 17.55" fill="none" stroke="#236ead" stroke-width="5.6" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M58 8L53.52 25.18L40.55 11.29Z" fill="#236ead" stroke="#236ead" stroke-width="2" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Exposure — brighten or darken the picture</title>
+  <circle cx="32" cy="32" r="25" fill="#e2e8ef"/>
+  <path d="M32 7A25 25 0 0 1 32 57Z" fill="#236ead"/>
+  <circle cx="32" cy="32" r="25" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M14 32L27 32M20.5 25.5L20.5 38.5" fill="none" stroke="#34465b" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M37 32L50 32" fill="none" stroke="#ffffff" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Fit product — frame the whole product in the view</title>
+  <path d="M15.98 22.75L32 32L32 50.5L15.98 41.25Z" fill="#b8c3cf"/>
+  <path d="M48.02 22.75L32 32L32 50.5L48.02 41.25Z" fill="#8e9faf"/>
+  <path d="M32 13.5L48.02 22.75L32 32L15.98 22.75Z" fill="#e2e8ef"/>
+  <path d="M32 13.5L48.02 22.75L48.02 41.25L32 50.5L15.98 41.25L15.98 22.75Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M15.98 22.75L32 32L48.02 22.75" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 32L32 50.5" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M5.5 18.5L5.5 5.5L18.5 5.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M58.5 18.5L58.5 5.5L45.5 5.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M58.5 45.5L58.5 58.5L45.5 58.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M5.5 45.5L5.5 58.5L18.5 58.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Frame guides — rule of thirds over the picture</title>
+  <path d="M10 14L54 14A4 4 0 0 1 58 18L58 46A4 4 0 0 1 54 50L10 50A4 4 0 0 1 6 46L6 18A4 4 0 0 1 10 14Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M23.33 15.3L23.33 48.7M7.3 26L56.7 26M40.67 15.3L40.67 48.7M7.3 38L56.7 38" fill="none" stroke="#6f879c" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="23.33" cy="26" r="3.6" fill="#236ead"/>
+  <circle cx="23.33" cy="38" r="3.6" fill="#236ead"/>
+  <circle cx="40.67" cy="26" r="3.6" fill="#236ead"/>
+  <circle cx="40.67" cy="38" r="3.6" fill="#236ead"/>
+</svg>
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>From Material — custom look crossed off, material shows</title>
+  <path d="M6 38L32 53.01L32 57.01L6 42Z" fill="#b8c3cf"/>
+  <path d="M58 38L32 53.01L32 57.01L58 42Z" fill="#8e9faf"/>
+  <path d="M32 22.99L58 38L32 53.01L6 38Z" fill="#e2e8ef"/>
+  <path d="M32 22.99L58 38L58 42L32 57.01L6 42L6 38Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M6 38L32 53.01L58 38" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M32 53.01L32 57.01" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="22" r="15" fill="#328bd3"/>
+  <path d="M46.1 16.87A15 15 0 0 1 26.87 36.1A19.62 19.62 0 0 0 46.1 16.87Z" fill="#236ead"/>
+  <circle cx="26.9" cy="16.9" r="4.05" fill="#b9ddf8"/>
+  <circle cx="32" cy="22" r="15" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M21 11L43 33M43 11L21 33" fill="none" stroke="#ffffff" stroke-width="6.65" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M21 11L43 33M43 11L21 33" fill="none" stroke="currentColor" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Ground — the floor the product stands on, with its contact shadow</title>
+  <path d="M5.06 42L30 56.4L30 58.8L5.06 44.4Z" fill="#328bd3"/>
+  <path d="M54.94 42L30 56.4L30 58.8L54.94 44.4Z" fill="#236ead"/>
+  <path d="M30 27.6L54.94 42L30 56.4L5.06 42Z" fill="#b9ddf8"/>
+  <path d="M30 27.6L54.94 42L54.94 44.4L30 58.8L5.06 44.4L5.06 42Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M5.06 42L30 56.4L54.94 42" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M30 56.4L30 58.8" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M30 35.6L45.93 44.8L34.85 51.2L18.91 42Z" fill="#328bd3"/>
+  <path d="M18.91 29.2L30 35.6L30 48.4L18.91 42Z" fill="#b8c3cf"/>
+  <path d="M41.09 29.2L30 35.6L30 48.4L41.09 42Z" fill="#8e9faf"/>
+  <path d="M30 22.8L41.09 29.2L30 35.6L18.91 29.2Z" fill="#e2e8ef"/>
+  <path d="M30 22.8L41.09 29.2L41.09 42L30 48.4L18.91 42L18.91 29.2Z" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.91 29.2L30 35.6L41.09 29.2" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M30 35.6L30 48.4" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Lens — the camera lens and its field of view</title>
+  <circle cx="32" cy="32" r="27" fill="#b8c3cf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="32" r="19" fill="#b9ddf8" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="32" r="8.5" fill="none" stroke="#236ead" stroke-width="4.25" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="21.75" cy="21.75" r="3" fill="#e2e8ef"/>
+</svg>
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Appearance library — looks on a shelf</title>
+  <circle cx="13" cy="28.35" r="9.5" fill="#b8c3cf"/>
+  <path d="M21.93 25.1A9.5 9.5 0 0 1 9.75 37.28A12.42 12.42 0 0 0 21.93 25.1Z" fill="#8e9faf"/>
+  <circle cx="9.77" cy="25.12" r="2.57" fill="#e2e8ef"/>
+  <circle cx="13" cy="28.35" r="9.5" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="51" cy="28.35" r="9.5" fill="#b8c3cf"/>
+  <path d="M59.93 25.1A9.5 9.5 0 0 1 47.75 37.28A12.42 12.42 0 0 0 59.93 25.1Z" fill="#8e9faf"/>
+  <circle cx="47.77" cy="25.12" r="2.57" fill="#e2e8ef"/>
+  <circle cx="51" cy="28.35" r="9.5" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="28.35" r="13.97" fill="#ffffff"/>
+  <circle cx="32" cy="28.35" r="11.5" fill="#328bd3"/>
+  <path d="M42.81 24.42A11.5 11.5 0 0 1 28.07 39.16A15.04 15.04 0 0 0 42.81 24.42Z" fill="#236ead"/>
+  <circle cx="28.09" cy="24.44" r="3.11" fill="#b9ddf8"/>
+  <circle cx="32" cy="28.35" r="11.5" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M7 42.35L57 42.35A2 2 0 0 1 59 44.35L59 46.35A2 2 0 0 1 57 48.35L7 48.35A2 2 0 0 1 5 46.35L5 44.35A2 2 0 0 1 7 42.35Z" fill="#8e9faf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Area light — angled panel and dotted direction stem</title>
+  <path d="M23.34 11L54.52 29L40.66 37L9.48 19Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="44" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="51" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="58" r="2.125" fill="#236ead"/>
+</svg>
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Light by highlight — dotted aim stem and sphere target</title>
+  <circle cx="32" cy="9" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="16" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="23" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="42" r="15" fill="#e2e8ef"/>
+  <path d="M44.29 33.4A15 15 0 0 1 23.4 54.29A19.62 19.62 0 0 0 44.29 33.4Z" fill="#b8c3cf"/>
+  <circle cx="32" cy="42" r="15" fill="none" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="37.5" r="5.5" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Point light — source disc and dotted direction stem</title>
+  <circle cx="32" cy="23" r="15" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="23" r="2.125" fill="#34465b"/>
+  <circle cx="32" cy="44" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="51" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="58" r="2.125" fill="#236ead"/>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Spot light — cone source and dotted direction stem</title>
+  <path d="M32 8L49 33Q32 43 15 33Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <circle cx="32" cy="44" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="51" r="2.125" fill="#236ead"/>
+  <circle cx="32" cy="58" r="2.125" fill="#236ead"/>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Lighting presets — a stack of ready-made light set-ups</title>
+  <path d="M24 5L54 5A5 5 0 0 1 59 10L59 40A5 5 0 0 1 54 45L24 45A5 5 0 0 1 19 40L19 10A5 5 0 0 1 24 5Z" fill="#b8c3cf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M10 17L42 17A5 5 0 0 1 47 22L47 54A5 5 0 0 1 42 59L10 59A5 5 0 0 1 5 54L5 22A5 5 0 0 1 10 17Z" fill="#e2e8ef" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M18.3 41.55A11.5 11.5 0 1 1 33.7 41.55L33.2 45.55L18.8 45.55Z" fill="#b9ddf8" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+  <path d="M21.3 45.55L30.7 45.55A2.5 2.5 0 0 1 33.2 48.05L33.2 50.05A2.5 2.5 0 0 1 30.7 52.55L21.3 52.55A2.5 2.5 0 0 1 18.8 50.05L18.8 48.05A2.5 2.5 0 0 1 21.3 45.55Z" fill="#8e9faf" stroke="#34465b" stroke-width="2.55" stroke-linejoin="round" stroke-linecap="round"/>
+</svg>
--- a/Show More
+++ b/Show More